The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices.
The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia.
Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.
out of curiosity, why is a self signed cert bad for this case? Can't the updater check the validity of the cert just as well regardless? Or did the attackers get access to the signing key as well?
> Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“
It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.
Notepad++ has way too many updates for a text editor. I purposely decline most of the nags to update for precisely this reason. It is too juicy of a target and was bound to get compromised.
If the attackers did limit themselves to a small number of Asian machines they gave up an absolute goldmine. I would venture to say a lot of technical people use notepad++ at work in jobs that would be very lucrative for an attacker to exploit. I know I definitely had an 'oh shit' moment when I read this and thought about where I have notepad++ installed.
“ The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.”
How do they know it was a Chinese group or even a state sponsored one?
I didn't say that to be pedantic, but to avoid that particular type of asker who isn't actually asking a genuine question here. After listing all the ways that Notepad++ (as an example here) suspects who they suspect, the asker then comes back with "Yeah, but how do you know?", as if that's some sort of gotcha. It's disingenuous. Even if the person I replied to isn't attempting this, I find it good to call out and get people to ask a better question: what's the evidence and why does that evidence point to this conclusion?
With enough effort, anything can be obfuscated. But effort costs money and also state level actors have limited funds and time and want to go home to their families ar some point and if the purpose was to get a message across (don't mess with china, otherwise face the consequences) there is no need to really hide the origin.
I can't help but feel there must some better venue for such messaging.
When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task.
I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.
I almost always see activists using the argument that if I don't like the messaging then I'm part of the problem. Somehow I doubt that, given I don't mind messaging at all, where it's appropriate.
Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not under attack by political forces or who benefit from status quo politics, I'd encourage you to simply reflect on that good luck and try to ignore the "politics" that others are deeply affected by and care about.
I don't care for the current status quo at all. The current administration has wrecked this country and completely compromised its position in the global economy potentially forever. But there is a time and a place for those arguments and activism, as well as the same for other parts of the world suffering from similar or worse issues. Like, I wouldn't be receptive to hearing about Ukraine every time I go to the grocery store. When I want to hear about it I go to the YouTube channels documenting it! They're very interesting, but I need to be in a space to receive it. Similarly there are places where I'm not specifically looking for it but where I'd be receptive because it's not immediately irrelevant to something I'm doing. Otherwise it is just noise. This is absolutely no statement about the status quo, but just how my brain works. It's also not a statement against activism in general, just about my personal opinion of it in certain places.
I want to start by saying it's good that you are at least taking the time to look for this information! Stay healthily informed.
I see this as a bad analogy though: you wouldn't hear about it every time you go to the grocery store. Or, at the very least, you wouldn't stop and listen for the fifth time. You already know, and that's the point: the intention of most activism in technology (at least that I see) is to make you initially aware of it so you start to seek the information out and learn more elsewhere. (...And to give themselves good PR. We love rainbow capitalism /s)
Instagram and Twitter both get your attention during election season because they want you to be informed about how to vote. To me, that's a similar thing.
> Otherwise it is just noise. This is absolutely no statement about the status quo, but just how my brain works. It's also not a statement against activism in general, just about my personal opinion of it in certain places.
I considered the majority of the population to be affected by repeated messaging, messages in the background, or in other words availability bias. So the messaging be having the desired effect on society in general but not on some subset who filter it out completely.
It has an effect on me too: it makes me begin to extra-quickly ignore any messaging of that sort. I become so tired of it that it starts actively frustrating me to see. And I bother people to take it elsewhere. This is a behavioral issue on my part, but I'm still struggling to justify to myself that they couldn't be getting more out of it by putting it somewhere more appropriate.
> I become so tired of it that it starts actively frustrating me to see.
Something similar, significantly different though, happen to a friend. They started distrusting the incogni.com after seeing their advertisements over and over again. To them they saw/felt/reasoned that only an untrustworthy actor would be pushing the messaging so much and a trustworthy actor would rely more on word of mouth via their good product inspiring people to speak up about them. I had to point out that they probably saw much more of incogni's advertising due to their rate and type of media consumption and most people probably do not get that level of exposure. If incogni lowered their advertisements to hit them correctly it would not be nearly enough advertising to reach the average consumer.
I see the frustration at the repeated messaging to likely be a natural protective mechanism. Instinctively reject repeated messages is not necessarily a bad instinct since manipulative people will use repeated messaging to manipulate, but repeated message exposure does not only happen due to an attempt to manipulate.
The whole reason why Notepad ++, vim, etc have to do this is because no one wants to take one for the team and protest/put their neck on the line.
I don't want to either, and indeed I really want others to do it for me. As such, I really want to see even MORE political stuff like this to hopefully create folks who will actually protest and put their neck on the line.
Similar reason why US military propaganda is good. I never EVER want to be drafted and indeed if you put a gun in my hand and military fatigues on me, I will die with a shot in the ass (because I am running away). Thankfully, we have a bunch of hardened 20-somethings "manipulated" into joining the military and protecting us so that I can be lazy.
So please ratchet up the politics and get others out so I don't have to. It's not that hard to ignore yet another plea for help. We do it every hour of every day.
It’s all well and good for you if you want to be a consumer of political content when it suits you, but for a creator, the creation’s whole purpose may be a delivery mechanism for their message which may otherwise go unheard. Not saying this is necessarily what Don Ho (Notepad++) is doing, but it’s possible. Create something so good that people can’t help but use it (preferably the demographic you most want to reach, for example a country with a huge base of Windows users) and then use it as your message delivery mechanism.
1. I don't want to see political messages in unrelated delivery mechanisms
and
2. I created $PRODUCT as a delivery mechanism for a political message
are equally valid.
I feel that the problem that comes about is when a $PRODUCT was not created as a delivery mechanism but is being co-opted into being one at some later stage; the audience feels deceived and the creator feels that the audience is ungrateful.
I'm not very familiar with Notepad++ (having never used it, nor experienced any desire to try it), but I'm fairly certain that the creator has been political long enough now that the audience cannot complain about the message being delivered with the product.
It's like complaining about Vim having a message for the plight of Ugandans - it's been there for decades; too late to complain now about it.
I'm more sympathetic to complaints over projects which never had a specific political message suddenly acquiring one when they realised what a large audience they had, or when new people join a decades-old project and introduce a political message that was never there before. I can sorta understand outrage then.
You may not be in the right state, but the point of that part of the website is that it's a donation link. It will drive some people to help. If it's at the cost of some others getting grumpy about too much messaging... that's probably still worth it.
i dont see how saying "no politics" is similar to asking "why is there political messaging literally everywhere" , do you see how conflating the two is the exact behaviour that the original commenter was trying to discuss ?
Choosing not to engage politically is not a neutral action. Life is politics. The world is full of people that are trying to control your life in a thousand different ways. Choosing to not engage in support or opposition to that control doesn't mean you aren't participating, it means your default position is letting them do what they want.
I do not think it is uncommon for someone to do this, then see the side they oppose win more in elections, public perception, etc then decide to engage more and that is "why is there political messaging literally everywhere".
Since we can't remove it, the next best alternative is to participate and advocate for responsible political engagement. I think until we have some shared understanding of what responsible political engagement is we will continue to have it everywhere.
the original commenter has explicitly stated willingness to engage politically , he has also stated this is not something he is willing to do when it is interrupting his seperate personal choices , concluding with an observation that others tend to conflate non-constant political will with a constant apolitical view. can you please explain how you are not conflating these two concepts ?
Is choosing to set certain parts of one’s life apart from politics equivalent to “choosing not to engage politically?” If so then shouldn’t every action that you take be imbued with politics, including the choice of how long you brush your teeth and when, where, and how you sleep? Or are certain things exempt from the rule, but not posting on HN? If that’s the case, why does posting on HN require political engagement but not, say, your interactions with the clerk at the grocery store? Are those of us who fail to inform every person we meet about our political views choosing not to engage politically? Even if we dedicate a certain portion of our lives to political engagement?
Edit: I’ll also add that political messaging is highly contextual. What is appropriate and effective in one place may be counterproductive or actively harmful elsewhere. Format and tone actually matter if you care about your pet cause succeeding, believe it or not.
I think this is a good example you provide about the store clerk at the grocery store, and I think you can expand this even further. Sometimes when I go to a store and am checking out they will ask me to donate to some random charity. Whether or not I care about the cause they are asking for money for doesn't matter at all in that moment. It annoys me and I don't want it to be asked in that interactions as that's not what I'm there for and not what I care to be put on the spot to think about.
I view these kinds of weird virtue signaling political statements on things like software to be the same. They do absolutely nothing and are just visual noise for nothing. Actually, this is a good example of where it can go wrong as it likely made the software the target of Chinese state-sponsored actors. So not only does it serve no useful purpose, it also can make you a target and piss people off.
You can't take a break from that. I have transgender friends who fear for their life every day. They don't know what is going to happen to their rights or their healthcare. I have diabetic friends who can't work and also fear for their life because losing Medicaid would mean they will stop being able to afford insulin and will die. This is what people mean when they talk about politics being important. It's not just things that don't affect you, which is what most people mean when they say they don't care about politics. As soon as something affects you, you will understand.
And if all you do all day is worry about someone else's or your own problems and politics you will not survive. Everyone has problems. Every single person has an issue that could cause them to die or a political event that could cause them harm. Your friends are not special or unique. There are billions of people who don't know if they will have food for their next meal, don't have money to pay rent, struggle with an addiction, etc.
It's okay to watch a show about knights and demons and enjoy it. It's okay to use a piece of software that doesn't code every release as a protest against something. Instead of judging other people for not burning out, maybe take a break yourself. It's okay and normal.
I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere. It drowns out all attempts at discourse for anything else, and Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics.
So, while I fully agree with your stance that banning political discourse is support for the status quo, I also think that it's reasonable to ask for it to be toned down a bit, especially when the politics and social issues of one country is basically drowning out everything else.
All that said, I'm talking mostly about HN or other community forums here. The owner of Notepad++ has the right to put whatever they want into their software, and if we're discussing that here on HN then it's an occasion where discussing politics is valid.
This is a good point. What would people think if there was constant political discussion here about, for instance, South Sudan and things happening there now? I'm sure there's bad stuff going on there and it's unfortunately, but if we had constant references to and discussions about the internal politics of South Sudan, I think a lot of people would get annoyed about issues that don't affect them at all in their day-to-day lives, esp. when they're coming here for discussions about technically- and computer-related topics. That must be how it seems for American political discussions.
Do you think it's socially acceptable to ignore everything that doesn't affect you personally? Many activists would certainly have you think otherwise. As far as I can tell, fighting that habit is a huge goal of activism.
A huge chunk of activism is pointless and annoying. Especially when every cause is lumped together into Activism (TM) and the Omnicause.
I don’t agree with them and I don’t think they should be in my software, or dealing with anything they don’t understand (for instance crime, homeless people, geopolitics, or really anything outside of overpriced vegan coffee shops). All they really do is end up getting Fox News people to vote for fascists like Trump out of spite
> A huge chunk of activism is pointless and annoying.
Activism can be annoying, but it's never pointless (not even when it fails to be effective).
> All they really do is end up getting Fox News people to vote for fascists like Trump out of spite
It wouldn't be worthwhile for activists to resign themselves to inaction out of fear of offending the "Fox news people". "Fox news people" are already more likely than not to vote for fascists like Trump, and they'll use any excuse/justification they're being fed including "I don't like the way the wrong people are using their freedom to protest the wrong things".
Yes. Activists also don’t focus on all causes, not even most. They cherry pick whatever topic is hot in that moment. Sorry, I don’t care about that when I’m browsing something about software.
When I care about politics I’ll deal with actual politics. Reddit won’t change my mind nor the world.
Same. I go to technical or other forums in order to pursue hobbies of interest and escape the political shitshow of the real world, not be reminded of it every step of the way. I don't want to be bombarded with their opinions on the matter, even if they were to align with my own. Virtue signaling becomes a slippery slope that only induces more division, anxiety and fatigue over those issues, while not actually helping with solving them in any meaningful way.
I find it can be appropriate to talk about politics around a project when a political situation is directly affecting a maintainer of the project or the project itself and is a genuine reason why there are delays, weirdness or other impacts somewhere. I appreciate hearing about such things for transparency's sake. It's just all the other stuff that gets on my nerves, where it's just tacking politics onto the project just because there's injustice.
For example it's very normal for the Tor project to talk about censorship and privacy. It's also fairly normal for Russian maintainers to speak out about how it's no longer possible for them to receive support due to sanctions. And I can understand if a Ukrainian maintainer has to focus on trying to survive or escape the country instead of developing their software. All of that stuff is completely fine and I wholly empathize with it. It doesn't bother me because it's not extraneous; it is directly relevant to the project. I also don't mind projects listing their preferred charities.
But I do roll my eyes when projects continue to pine on about Taiwan's independence or the genocides in Gaza. If there isn't a reason why it's actually relevant to the project, I don't think the project page is a good space to push it.
> Do you think it's socially acceptable to ignore everything that doesn't affect you personally?
Yes, yes, and yes again.
> Many activists would certainly have you think otherwise. As far as I can tell, fighting that habit is a huge goal of activism.
That's their problem. As soon as you start contributing to them, you will not pursue your own goals, living your own life, but those imposed by activists or their supervisors.
It's convenient for them, you give them a political resource. But why do you need it?
That may be a huge goal of activism, but activists do not get to control what other people want to do.
Activists wanting something is not synonymous with that thing being a good idea. It just means that someone wants something out of you could be good, could be very bad. No different than a sales person trying to get you to buy something.
>Do you think it's socially acceptable to ignore everything that doesn't affect you personally?
No one has the time to pay attention to every little injustice in the world. For all the people crying about Gaza, how many of them are dedicating as much energy to the wars in Sudan, Yemen, or Myanmar, or the abuses by Russian security services (like imprisoning a guy for holding up a blank card)? This isn't to say that we should just ignore Gaza or Ukraine or ICE in the US, but we need to make a choice: either we spend ALL our energy addressing every injustice in the world, until there is no more injustice left (and this means we need to stop everything else we're doing now, including keeping society running, making food, etc.), or we need to choose when and how much attention we'll devote to various issues.
I am an American and I make a very conscious effort to appreciate social and political nuances. And I go out of my way to point out nuances to others who, in my opinion, oversimplify their statements. It could be argued that the expression of stereotyping Americans as lacking nuance, itself lacks nuance. I believe really most people are similar in that we have our biases, differences in context and experiences. We can all try our best to be as nuanced as possible.
I think that the stereotype of Americans lacking nuance around political issue is valid. Obviously, like all stereotypes, it’s not 100% true but Americans seem to feel obliged to pick one side of an issue, most of the time aligned with the worth of their choice, and then to view everything that’s happening through that lens.
Try to point out to a democrat that Trump is doing something right or to a Trump voter that Biden did something right. Most of them can’t accept that. The “other” side has to all bad. I don’t see this to such an extreme in other countries I know like Germany or Spain.
My personal take is this is a consequence of the two-party system. In the US you can "identify" as a democrat or republican. Once you do that, you don't _have_ to think, you can let tribalism guide you.
If in another country I vote for these guys or sometimes those other guys, and once this little party that got a seat, but not really those ones, and I really hate these ones, then your "political identity" already has a lot of nuance. In Australia with preferencial voting, a single vote has a lot of naunce.
What can you get in America? Green Party supportors who "strategically" vote for a democrat? Not much else...
Does the existence of an alt-right WannaBeNazi party in modern Germany preclude the existance of a spectrum of views within Germany and usher in an inability of a majority of Germans to express themselves with nuance though?
By all means make a considered and thoughtful point, please.
Saying Americans lack nuance is like saying Germans are bureaucratic or British have shit food. It's not true 100% of the time but it's true enough broadly enough to be a valid statement.
What really do Americans know about Ukraine or Taiwan? E.g. can even 1% of US population show Ukraine on the world map (without using Google Maps)? Could they do it before 2022? Before 2014? Do they know anything about Ukraine or Taiwan history? How many Americans know a single foreign language?
If tomorrow there would be a war or protests in, say, Burundi. Will Americans stay with Burundi or against it? Or with the country the media will tell them is "good" because their interests align with US interests?
I think answers to all these questions are obvious.
To be fair, lack of knowledge of other countries is hardly uniquely American. As an Irish person travelling around the non western world, there's a lot of people who don't know that Ireland is a country separate to the UK, or even that it exists.
> the issue is with specifically US politics and social issues being everywhere. It drowns out all attempts at discourse for anything else
Unfortunately, US politics also drives tech issues elsewhere like the EU. For example, local data control is a big thing that some of us have been screaming about forever but nobody paid attention to--until US politics made it a hot button issue.
And, to be honest, if the EU would get off its ass and at least try to foster some alternatives, even those of us in the US would benefit. EU alternatives would mean that people in the US could finally vote against the megajillionaires with their wallets.
> Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics.
Bullets and beatings don't leave much room for nuance regardless of country.
>And, to be honest, if the EU would get off its ass and at least try to foster some alternatives, even those of us in the US would benefit.
What exactly do you want the EU, the Brussels based institution, to do here? Because AWS didn't come into existence because Uncle sam came in and twisted Bezo's hand telling him to invent a hyperscaler that will conquer the world.
EU's lack of comparable domestic alternatives is a consequence of the failure of its entrepreneurship and free market in the SW private sector, and nothing that EU institution can do about it to magically fix this since the solution is not MORE regulatory interference form government bureaucrats who don't know how the internet works.
You might be able to force innovation if the governments can throw money at the problem if the VC sector is lacking, but they can't force economies of scale and mass adoption without a China style great firewall, in which case you'd then have even bigger issues.
The EU is trying but these things have to happen bottom–up. The EU Council or EU Parliament isn't a software development shop. They allocate funds to groups like NLNET who allocate them to a selection of the projects they get proposals for. NLNET can only allocate funds to something an individual or small group proposes. If you want to propose something, please go ahead.
Capitalists can also start software businesses and sell their software, but those are all in Silicon Valley because the money is there because the US has a privileged financial position.
I see a couple EU companies, but no EU governments. It takes a paltry $15K to be a Platinum sponsor.
I picked KiCad because PCB design is critical military infrastructure, the alternative programs are almost all under non-EU jurisdictions and could be pulled, and KiCad is both open source and local desktop to top it all off. This is exactly the kind of quiet, unflashy toil that desperately needs support from a government entity.
Lots of areas need support for open source alternatives that are controlled by proprietary software that might vaporize. I picked PCB design because it's an easy target. Cadence and Synopsys have locks on VLSI design domains that could get yanked from the EU. VHDL tooling is still disastrously poor. Everybody could use an alternative 3D modeling kernel (the EU is a little better here because the dominant proprietary kernels are from Dassault Systèmes and Siemens). I'm sticking to software as the domain because the purpose of the funding is obvious (pay developers, duh), but it also applies to things like small manufacturing and maintaining domestic supply chains (but the purpose and focus becomes a lot messier).
And yet, everywhere I look, any project I pick, crickets.
I don't expect the EU to front run, but something like KiCad is 3 bloody decades old.
> those are all in Silicon Valley because the money is there because the US has a privileged financial position.
And yet you had the rise of Akihabara as an electronic parts mecca which then later got eclipsed by Shenzhen. And that's not even talking about the fact that the modern computing sits atop a mountain of stuff developed out of the VLSI Project (https://en.wikipedia.org/wiki/VLSI_Project).
All of those occurred because their respective governments threw money around.
Sure, maybe you won't create another Silicon Valley hare, but, perhaps, just perhaps, you might create a relentless, open source EU tortoise that slowly displaces the proprietary software. The EU is good at slow--relentless, not so much.
best solution to this is a closing of borders and fragmentation of the internet to local regional segments. i know it sounds backwards but it seems thats where we're headed
> I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere.
I mean, yeah. Most major social media services used in the West are based in the US. The single largest English as a first language population is in the United States.
Given how many users from outside the US are oft wont to opine on our state of affairs even during the good times - often without even being asked - I like to think they'll endure our discourse.
Nah, it doesn't mean they support the status quo. It just means some political tactics are pointless, incompetent, and counterproductive.
Political opinions about how things should be don't automatically dictate the actions that should be taken in support of those opinions. I can be mad about a law or a court decision and still have the good sense to, for example, not throw red paint on a lawmaker or judge.
Some behaviors just aren't helpful, and neither being right nor being upset changes that.
> Whatever stance changes nothing .. is a vote for the status quo, by definition.
As problematic as the assertion "by definition" is aside, it should be noted that endlessly commenting about politics on internet forums effectively changes nothing.
I've been kettled by mounted officers and hit by high pressure hoses on cold evenings, something that also rarely effects change .. but that's a least a fun night out with people and better than wasting bits on the intertubes.
Whether it's a waste is not entirely up to you. There are plenty of people on this forum who are completely naive and live in a bubble. The chance that a comment they see her could make a lightbulb go off is non-zero.
So write good comments, neutral in tone, avoid preaching, stick to the facts, gently emphasize how laws are being broken without an excess of righteuosness, see the people whose opinions you oppose and find common ground to pivot to your position, etc.
FWiW I recall handing a guitar (I hear they kill facists) to Billy Bragg way back when he was on tour Talking to the Taxman About Poetry and FYI he's back, again, following Springsteen: https://www.youtube.com/watch?v=IKOW2ZikGW8
I wouldn't say that avoiding political discussion yourself because you can't handle it is a vote for the status quo, but telling others not to talk about politics is definitely a vote for the status quo.
Doesn't that depend entirely on the context? Telling the grocery store not to carry dairy products is an anti-dairy stance. Objecting to dairy products in the vegetable section is not anti-dairy it's pro-keeping-things-organized. Debating whether or not dairy ought to be allowed in the vegetable section is also not anti-dairy, at least in the general case.
Maybe, but telling people who are speaking to their audience on the platforms that audience is voluntarily visiting that they need to shut up is even more pointless, incompetent, and counterproductive.
Notepad++ is free, open source software for which there are dozens of alternative packages of equivalent quality. The entire cost of using this software and benefiting from the work of the developer, is having to scroll past or close a few political opinions.
If the reaction, if someone vehemently dislikes this sort of thing, is to tell that developer to "just shut up and make your software" rather than to stop using that software? Then I think that's possibly the most entitled and hypocritical position that I think it's possible to have.
Notepad++ maintainers can do whatever they want. I don't care. I'm just taking apart this tedious, superficial, self-serving activist cliche about how not being an activist is supporting the status quo. Some people want change just as much as activists do, but they have different ideas about when and how it's helpful to be an activist.
The good sense is your judgement. At some point a real, direct, disruptive protest is going to be the right solution for a big enough group of people. Peaceful protests are just a "we're starting to get there" signal. It's not like politicians normally say "gee, lots of people don't like how I abuse power, I guess I'll stop now". It's all about being collectively upset enough about status quo.
This is about being productive and weighing the overall value of things.
The politicisation of software is as harmful as requiring every research paper to be published with a political allegiance banner.
Software like most Sciences, Engineering, and, Trade is a much longer game for humanity than politics de jour.
It is easy to forget the extent of contributions from all sides of politics that has contributed to this trade, from Mohammed Algorithm to English, Russian, Chinese, and, everyone else to computing; but forgetting that and forging that for quick political hack points is a disservice to humanity.
>Software like most Sciences, Engineering, and Trade are much longer game for humanity than politics de jour.
Not really, software, like sciences and engineering must survive politics first. If humans start tossing around nukes like angry apes then those that survive may be scratching simple arithmetic with a charcoal stick on a cave wall.
Science has absolutely engaged in the politics du jour, including in major world wars. See, for example, the Szilárd petition[1]. (If you need a post-WWII example, those same scientists continued petitioning after the war on the dangers of nukes, too.)
Further, political banners in software have absolute helped, and have changed political outcomes. As an example of that, SOPA, and later PIPA, were defeated by websites such as Wikipedia (which are software) putting banners aimed at informing the public of those bills.
> whenever you engage in your trade or profession is not the same
Feels like this is overstating the facts. Afaik, twice did the author on N++ did include a small political message in a release.
Is it really "whenever"? Blowing this out of proportions because some are so allergic to any political message that twice in 10 years is being pushy..
In the end, everything involving more than 2 humans is politics. You may want to ignore some topics, but those may be important to others. Until the day you yourself want to bring some attention but you're met with an "apolitical" response saying it's not the time or place for it.
>Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is.
Before I respond to your comment, allow me first to acknowledge the following injustices happening in the world:
* war in gaza
* war in ukraine
* civil war in sudan
* civil war in yemen
* civil war in myanmar
* ethnic violence in syria
* insurgent attacks in nigeria
* insurgent attacks in congo
* attacks on protesters in Iran
...
Wait, what's that? You don't want every comment to start with some sort of land acknowledgement-esque disclaimer of all injustices happening in the world? What are you, some sort of gaza war/ukraine war/sudanese civil war/ ... sympathizer? Tens, if not hundreds of millions have been affected by the event listed above, so at the very least you can spare a thought for them before discussing about some text editor getting compromised? You might argue acknowledging the war in gaza is beating a dead horse, but do you think the median HN reader has thought about the civil war in myanmar in the past month?
> Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads
In the context of forums, the political threads are generally /not interesting/[0]. Political threads often devolve; they bring nothing 'new' or 'fresh' to the table, and they lead absolutely no where. It's a fart-in-the-wind situation no matter what your position is. Leave that stuff on reddit where the rest of the farts-in-the-wind go to waste. It's like watching commentators on Fox News or CNN or <insert favorite cable TV show here>. They're a large waste of time and they're often geared towards re-enforcing your side, aka echo chamber.
Now, if a thread actually evolved into real measurable action, that might actually be interesting. But that's not what happens on these forums. There's probably very few of us that see some HN thread talking about something awful happening somewhere and they take direct action, such as petitioning their government, protesting, etc. It's probably happened once or twice, but most of the farts in those threads just hang around and stink up the place.
The issue with making something so universal as software, specifically scientific software political is that it operates in such a broad context that every political statement sooner or later will seem comical outside a very narrow scope.
Your comment is a good example of it; who is dictator? The people who hacked the software or the political pole they support? At what point did they become fascist enough to warrant politicalisation of everything ?
If the main problem is that "sooner or later it will seem comical" I don't think this problem is severe enough to justify the number of words that have been written on HN about this topic.
> One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political.
apparently, it's OK to have this stance of "if you're not with us, you're against us".
It's absolutely possible to not want political discussions in various places - it doesn't mean you support one or the other side. It simply means you don't want that discussion here. You could support the incumbents or not - not wanting the discussion does not imply support for the incumbents.
it's not the mere lack of being with, it's the enthusiastic, public advertisement that you are not with. If you are actually neither with nor against, then you don't have any need to say anything about the issue at all. If you make a big deal about not being with or against, most people who do that are against but don't want to say so.
Not wanting politics crammed into every nook and cranny of daily life is not a "political" view of one kind or another, it's a preference for how I want to consume information and interact with people.
There is such a thing as being able to act and think in ways that aren't political in nature. Maybe not for you, but it absolutely is possible.
Way to completely and totally miss the point. I don't actually think you could've missed the point any harder than you did.
Politics are quite literally life-or-death for many people. War is politics. Access to healthcare is politics. Economic policy that determines whether businesses and careers succeed or fail is politics. Freedom to say what you want, believe or not believe in whatever religion you want, and be who you are without being imprisoned is politics. The people who make the most noise about politics are the people who are literally dying for as long as the rest of society ignores their plight.
If this isn't the case for you, it's because you benefit from the status quo. It is the definition of privilege to be able to "ignore politics". That means you are currently benefitting from politics. Of course you don't want to hear about politics, politics are doing just fine for you. And the comment you were asking to was asking you to reflect on that: if the biggest problem gracing you is hearing other people make noise about circumstances, the least you could do is deal with it. Your problems are trivial if that is what gets you upset. Other people are complaining about things that affect the outcome of their lives and you're complaining about... having to hear it.
That you seem to believe politics exists to solve people's problems is probably the reason you feel it is so important. I'm sorry that you are so profoundly confused.
Oh, you're one of those bootstrappy libertarians, I'm taking it. Everything you've ever done is by your own two merits, right? Nevermind the fact that you take society's roads and use society's technology, which are the results of politics. You drink society's water and eat society's food, which are the results of politics. You enjoy the security of not being invaded by enemy tribes nor your neighbors, which are the results of politics. "Politics" is simply a word describing how humans act in groups. Given that how we act in groups determines the entirety of our lives, there is no separating anything from politics. You seem to have taken my comment as "the government is responsible for solving people's problems", but politics are just as much about dealing with the problems it creates. When politics are going well you can ignore it; when they are going poorly they can end your life so you make a lot of noise about it to get other people to try to care. In either case, though, your life is entirely the result of political forces unless you're living in the jungle completely detached from society.
I live in a society that feeds me and rewards me for work and does a whole host of other things for me. I am grateful for all of it. Many other people are not so well served by society. This is all true. None of that has anything to do with politics.
Politics is a game. It is played with one single objective: to make sure that the people with no political power remain fighting among themselves instead of fighting those with power. If you believe some favored political faction will solve these problems you mention, then it is you who is missing the entire point.
I'm taking you're from the US from the "either team" comment. That is a really elementary understanding of politics. Politics, again, is a word describing how humans behave in groups. Where are roads built? That's a political decision made by groups of humans reaching consensus. What is the budget for the local security force? That's a political decision made by groups of humans reaching consensus. How much money is going to be collected from everyone locally to pay for those roads and security? That's a political decision made by groups of humans reaching consensus. If you're even allowed to participate in the consensus process... that itself is politics! For most of recorded history, decisions were made by the consensus of clergy, nobility and royalty, who coerced the rest of society into supporting their consensus through organized violence. Are you allowed to own property? That is the result of your group reaching consensus saying you're allowed to.
> How the produce of society is distributed and how people are cared for has zero relevance to an article about hacking a text editor,
The article is political. People make noise about Taiwan because an invasion of Taiwan would kill many and oppress more, in other words because it, like all political matters, is something that determines the course of lives of millions. Even if they are not directly affected, noise about politics escalates as a mechanism for people to protect themselves. When you are at the wrong end of a group that outnumbers you trying to kill you, you will require the aid of others. But will others come to your aid if you were not willing to come to their aid? This is how the concept of a "conscience" and "empathy" evolved -- because they give an evolutionary advantage, of providing for your own survival by ensuring collective survival.
Edit: for posterity, the comment I was replying to mentioned a "belief in either team leading you to the promised land", which has been edited out.
You know what's even more important than politics? Water. That doesn't mean I need to read a prologue about water in every HN article reminding me that I require water to survive.
You seem very angry at a stranger on the internet. I think a break from thinking about everything through the lens of politics might be good for you.
> You know what's even more important than politics? Water.
Access to water is political. If you get water from the city, the building of infrastructure delivering water to your residence is political. Whether or not that water is polluted is political. If you get your water from a well on your own property, your ownership of that land is political. None of that is achieved without group consensus, and group consensus can take all of it away from you. You are able to ignore that fact because all of those political consensuses are currently going in your favor, but the same is not true for everyone, and when it isn't true for them, they can be predicted to make noise about not having access to water for obvious reasons. They will make noise about it everywhere they can because it will be more important than anything else to them, given that it will determine whether they live or die and they need to galvanize communal support in order to reverse their fortunes.
> You seem very angry at a stranger on the internet. I think a break from thinking about everything through the lens of politics might be good for you.
My previous comment was written entirely neutrally, so I'm not sure how you came to that conclusion. Incidentally, I happen to live in a prosperous and stable society that I have confidence will remain secure for decades to come, so I have the privilege to ignore politics at my leisure. I am grateful for that opportunity, but I also understand how much of a privilege it is that politics are going well and not actively creating problems for me, so when other people complain about political processes creating problems for them, like the threatened invasion of their country, I listen without complaining.
I took HN as a place for rational discussion, so I made an effort to communicate to you why politics are so important to many, but in the end it seems this discussion is fruitless. If there is any emotion I feel, it is that of disappointment for wasting my time trying to discuss things logically and rather than being met with any kind of reasoned rebuttal, I get a childish dismissal the likes of which I could've gotten on Reddit, which I stopped using for that very reason a decade ago.
> You know what's even more important than politics? Water. That doesn't mean I need to read a prologue about water in every HN article reminding me that I require water to survive.
Ah but didn't you know, some activist professor with a stick up his ass once said "everything is water" - so even not wanting to talk about water is in fact your water privilege of not talking about water. /s
But you do see questions about water usage for AI in data centers?
Articles about families living close by, which water bills exploded recently?
On the other hand, you don't see commenters saying that they are indifferent to their access to water, and that they are tired seeing others being engaged in the conversation.
If it's not impacting you, I don't blame you not participating. But I feel (general) you don't get to push down on others because they are discussing important topics (to them).
People will start talking about water when a water shortage starts impacting their day to day life. For the average western world resident, water is not a problem, yet. But I bet you people in Tehran cares a fuckton about their water running out.
The same with politics. When politicians keep their hands off the society, no one feels pressed to talk about politics. When an authoritarian regime compromises a widely used open source software to conduct espionage, of course people will start talking about politics.
> Asking for "no politics" is itself a strong political view
No, it explicitly is not, and this "deepity" doesn't change any rational analysis. The injection of politics into every aspect of society must and should be refused.
Politics is more of a way of thinking and speaking than about any specific topic. For those of us who see a lot of problems with society but know that things will never be how they "should be", it is healthy to limit amount of time spent thinking about problems that cannot and will not be solved.
please tell me about the intricate politics of a phone booth. just because you can make everything political doesn't mean it is inherently political or doesn't make you look like a terminal online annoying loser when you try to compensate for your vapid personality outside of ideological dogma.
Not wanting politics on HN, need not imply support of the status quo, or even a lack of interest in politics. It can simply be a different belief about the purpose of online forums.
I read about politics all day long in many different places. My belief that HN should be relatively free of such stories is not because I believe I can detach myself from politics, but because I believe topic based forums are more valuable and useful than “anything goes” forums.
Allowing politics on HN doesn't mean discussing politics in every thread. If it's a story about someone who improved performance of their system by using Rust then sure there's no need to bring anything political. But threads about Nvidia, Tesla, encryption, internet blackouts, social media, startups investments, etc, all warrants political discourse.
I wish that were true, but in my experience so far, it isn’t.
Not only does politics and general stories crowd out everything else over time on other sites, there are HN submitters who seem to be trying to accelerate this.
During the war, when HN was getting Israel-Palestine stories constantly, I started looking at the submission history of some of the submitters, and some of them were just pushing these types of stories every day for months and months.
So yes, I think allowing politics will eventually mean being dominated by politics and general interest.
Globalizing the intifada means pushing an agenda everywhere, including on HN, on posts where it is relevant and on posts where some obscure or conspiratorial connection can be made.
If HN is going to allow accusations to be slung against groups of people it has to allow others to respond, and that sets off endless debate amongst people who will not be changing their minds on the matter but will repeat the same argument on the next post.
Fully agree, it’s akin to atheists, they very often are convinced they are not religious. Agnostics are the unreligious ones. In fact, atheists are the most fanatical zealots in my friends circle.
I'm tired of this. I look anywhere, I see politics. At the end of the day all this does is alienate me from anything that isn't the status quo anywhere, because all I see of the opposition of it is constant incessant whining and the prevention of my relaxation. It's a selfish view but I don't care.
I disagree. I want to separate my technology from politics. I consume politics through other venues. I don’t want HN full of political articles. It doesn’t mean I support status quo. It means I don’t want this one website pushing politics, which it increasingly does.
HN discussions are usually very high quality and respectful disagreement therein, which is unique online nowadays.
I’ve come here to escape Reddit, which is all politics all the time. If this place turns as political as Reddit, I’m out.
Vim is Charityware. You can use and copy it as much as you like, but you are
encouraged to make a donation for needy children in Uganda. Please see |kcc|
below or visit the ICCF web site, available at these URLs:
I am just fine with people tagging their art and their craft with causes they believe in. The person behind the work is part of the work. If you didn't pay for it or contribute sweat equity you don't get to decide otherwise. Your only recourse is to not use it.
Any other venue would be less effective. Many people use Notepad++, few people care about the opinions of the person who makes it. Segregating their opinion to a space where it would be ignored by anyone who wasn't already interested would barely be better than staying silent.
> I can't help but feel there must some better venue for such messaging.
I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it.
Another angle: would such free protest be allowed if the developers of Notepad++ were based in China or Russia? I seriously doubt it.
I'm referring to (if we would continue with the list):
- Ukraine for Donbas
Which is so much weaker than all others. There are Ukrainians, Russians, Chinese, Tibetans. But there is no such ethnicity as People of Donbas.
OTOH in a democratic state you're still have the right to demonstrate peacefully for whatever you want, even if it doesn't make much sense. But would you allowed to demonstrate in Ukraine for Donbas independence if they are considered separatists according to the law?
"Say" in the sense of demonstrate peacefully for this? Then I'm impressed. If someone else can confirm this? Is this because of USA being a federal union? Before Ukraine declared independence, there were voices to make Ukraine a federal state, so that people in the West part of Ukraine can live their way of life and people living 1600 km (!) away in the East and Southern parts would be not much affected from that and vice versa. Voices for the unitary state were stronger because of stability of the state. Would be interesting to see some documentary "what if", whether a federal state would be more stable against pulling from the west (Europe, US) and the east (Russia).
> Is this because of USA being a federal union? Before Ukraine declared independence, there were voices to make Ukraine a federal state, so that people in the West part of Ukraine can live their way of life and people living 1600 km (!) away in the East and Southern parts would be not much affected from that and vice versa.
You are falling for Russian propaganda about evil western-Ukrainian nazis attempting to enslave peaceful-Russian-speaking-peoples-of-Donbass-or-whatever who were just minding their own business ("way of life"). As a Russian-speaking Ukrainian neither do I want Putin to protect me (apparently by looting my apartment and raping my girlfriend or in whichever way he is trying to do it these days), nor do absolute majority of population of, say, Kharkiv, Odesa or Kherson.
> Voices for the unitary state were stronger because of stability of the state. Would be interesting to see some documentary "what if", whether a federal state would be more stable against pulling from the west (Europe, US) and the east (Russia).
As a Ukrainian I find that idea quite laughable. It is not really possible for a part of federal union (say a state of USA or a Swiss canton) to join NATO and for other part to "decide" to become a Russian-occupied quasi-state like Belarus. Same goes for a part of it joining EU while some other part decides it wants to be part of EAEU Customs Union. State's foreign affairs are still decided by some central government.
Also, you can research how great "deciding on their own way of life" works in Russian Federation. You could start with first and second Chechen Wars.
I was glad after discovering [1]. In one of the videos the interviewer explains, why he was not arrested. The channel is for English-speaking auditory outside of Russia. It was enough to "close eyes" for some openly expressed critiques. Though it was painfully to listen to some people who were not against the war.
> I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it.
I think about a lot of things I do absolutely nothing about (or with).
Thinking about whatever messaging is here is like saying "thoughts and prayers". It means shit all nothing. The messaging was a waste of my time and your time. It was an ad for a product you'll never purchase.
I don’t see it as a waste of my time. I am not in the habit of seeing conflicts in which innocent people die as a “waste of my time”. The idea that my time is somehow more valuable than another person’s is narcissistic.
Yet more "thoughts and prayers" rhetoric. If you want to actually be engaged, go do something directly for those people. Until that point, it's simply thoughts and prayers.
Typically when I see such messaging in an out of place venue it nudges me slightly against both the message and the venue pushing the message. This occurs regardless of whether I agree with the message. I feel the same way as when I see an ad: this does not belong here.
I don’t think I am the only one who has this reaction. People who do this should consider if it’s actually helping their cause. If not it’s just feelgood signaling, or possibly even counterproductive.
I know it's real. But it doesn't excuse giving away one's values just because something inconvenienced them.
As an example, do I find some vegans annoying on the internet? Yes. Does it mean I will instead start supporting carnism, or push back on veganism? No, absolutely not. Because these are values I have, and no actions of others can change what I value.
The fundamental values don’t often change, but if you alienate people enough they will shift their activities to supporting a different cause they care about, or give up and tune out entirely. It’s self-defeating. You can’t win with radicals alone.
Based on arrest of protesters in UK, US, and recent laws passed in Australia; it is fair to say that Notepad++’s freedom to protest would depend on who and what they are protesting.
Just try to protest decades long ethnical cleansing and war of occupation occurring in Palestine in the USA of the UK, for example, like some students and people did in good conscience.
You're a tad idealizing the limits of freedom of speech in the western countries.
Letting people on to the Internet without censorship is political.
Government policies that support startups are political.
Threatening to arrest teens for pirating mp3s is political.
> I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.
For the people actually impacted by politics, reality rarely waits for a convenient time to interrupt.
Political reality tends to knock down doors and blow up buildings when it wants to really get someone's attention. "Don't bother me during my software updates" is a privileged position to be able to take.
It’s an excellent venue, just like songs and movies.
Being political isn’t a hobby you attend on Tuesdays, it’s real decision that affect people’s lives every single day, sometimes with deadly consequences.
Notepad++ is close to a personal project. The author can add any message he wants. Usually, he just wrote something in the updating log; most people do not read it anymore.
If the political messages said "gas the Jews", "exterminate the Ukrainians and give Ukraine to Russia", and "Taiwan has and always will be a province of china", you probably wouldn't use notepad++.
>A majority of countries (119 or 62 per cent of UN member states) have endorsed Beijing’s one-China principle, which entails that Taiwan is an inalienable part of the People’s Republic of China.
I was being generous bucketing 20 mixed signallers with 40 status quoist. 120 agree TW inalienable part of China, as in TW can never be independent from one China construct (PRC's position). 20 agree it's part of China but not necessarily inalienable, i.e. TW/ROC should have pathway to independence but until they formalize, still part of China. AKA 75% is in recognize tier.
Only officially, because it's a requirement to retain trade relationships with China and China makes everything.
Everyone, including 99% of the world's politicians that don't have their heads up their asses, including the ones who wrote the official positions that Taiwan is not a country, knows Taiwan is a country.
>If the political messages said "gas the Jews", "exterminate the Ukrainians and give Ukraine to Russia", and "Taiwan has and always will be a province of china", you probably wouldn't use notepad++.
As one should, I avoid stuff that have a very loud fascist author/owner. So we should be happy for this people to show what they believe in, this way we can decide not to help fascists(and others can decide to support them and not to help one of the other sides)
No politics in software, in sports, on HN, at work, at parties, ... it becomes a rare thing, widely 'censored' (socially, not by government), when it is the most important thing.
The GPL license is politics. Should it be removed from all software? Then you won't have any right to use the software. That could be a problem. Politics determines which software you're allowed to use.
> People will tell me again to not mix politics with software/business. Doing so surely impacts the popularity of Notepad++: talking about politics is exactly what software and commercial companies generally try to avoid. The problem is, if we don’t deal with politics, politics will deal with us. We can choose to not act when people are being oppressed, but when it’s our turn to be oppressed, it will be too late and there will be no one for us. You don’t need to be Uyghur or a Muslim to act, you need only to be a human and have empathy for our fellow humans.
> When I see politics in software updates or documentation, nothing happens
I find this take deeply ironic.
And here due to alleged political take of some software (Notepad++), __state sponsored software__ was used to attack users of said software. Something actually happened!
You don't want to see politics in any software, but may be (or already are) a victim of political software attack (from state sponsored tracking, to sanctions, to political psy-ops through software distributing (social) media).
> <...> Maybe I tell my adblocker to remove the messaging, and carry on with my task.
>
> I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.
You are clearly annoyed by ads, like many of us - maybe you should get public attention to change policy about ads? How they are annoying? How there are unskippable Ads in TV services that I pay money for? How there are big enterprises using their monopoly/oligopoly powers to make you stop being able to adblock ever again? Or do you only block ads you deem "political"?
_______
States (and not only them) will use software and even open source software (open source IMHO is also a political take/view) to get to you if it's ever needed. Though congrats you just got extra social credits in __both__: China's and Palantir's databases!
Bro, it's political. Political isn't synonymous with "bad" or with "propaganda". Wars are waged on many fronts, and securing economic and hardware support takes messaging.
I'd say politics is war by other means. First we killed each other for resources. Then we decided killing sucked, and if your tribe doesn't kill my tribe, my tribe won't kill your tribe, but now we have to decide how many resources we each get. It's hard work to keep things like this and avoid reverting back to the default state.
My opinion is that open source documentation is like polite dinner conversation: It’s not the proper place to discuss politics.
If an author wishes to use their open source project as a platform to discuss politics, that’s the author’s prerogative. But then, as perhaps in this instance, it could be to the detriment of the project itself.
> My opinion is that open source documentation is like polite dinner conversation: It’s not the proper place to discuss politics.
I know this is a common turn of phrase, but I can not help thinking that if the political conversation is impolite it is because some in the conversation is being impolite not due to the topic itself.
This is a zero sum take. There are no winners, only the people you deem using free expression correctly. Would a developer who names releases like "Ukrainians are nazi's" or "Taiwan is China" be met with this same sympathy? Or would you brush them off as a mouthpiece for those governments? I'm thinking it's the latter. Free expression is rarely anything other than socially acceptable expression.
IMO the ethical response should be positive disengagement with entities with which you disagree, instead of negative engagement.
See something in the release notes of an app you don’t like? Go use a different app, give your money to a different entity. Don’t spend your time and resources messing with the producer or user of the thing you don’t like.
This of course runs the risk of maximal polarization once everyone has filtered themselves into their neat and tidy little bubbles. What happens then, everybody leaves each other alone? Or do the echo chambers slide into further radicalized detachment from each other?
I mean it depends what it is. If someone is talking about master races in patch notes I think that can be met with negative engagement. Splitting along an ideology binary can definitely lead to further entrenchment and possible radicalization. I think the danger there though is the binary choice itself. You of course have edge cases where it is a binary, but I think having people with more complex attitudes and opinions can only be a boon to cooperation and progress.
To get back on topic though, I think conflating using Y app with holding X position on a topic like politics is a dangerous road. Which is where I think having a dedicated space for those politics makes more sense. Whether that's a blog, twitter, etc. It allows those most dedicated to you to know you better without making the product or program a political stance. But the developer is ultimately free to do what they want. So it's not like anyone here can tell the developer to change in any way.
What a bad take. Not every political statement is morally equivalent nor worthy of the same respect. Supporting self-determination of people is not the same as supporting oppression of people - for example.
So the free expression is considered by everyone according to their own ethical and moral values.
This is a very head in the sand approach to life that only those who are entitled may partake in. Reality is that most cannot live in ignorance of what is happening around them because it is also happening to them. Obviously not everything needs to remind you of stressful reality, but we also shouldn't avoid reality just because we are privileged enough to do so.
That’s true. My point was intended to be from the author perspective, rather than from the user perspective. Namely that an author using an open source project as a political platform can potentially put the project at risk. Rightly or wrongly, that’s the world we live in. So it’s a trade-off the author has to decide, one way or the other. I’d personally prioritise the project over the political. But the Notepad++ author is free to use their project how they like. It’s theirs, after all.
Ah, so this has to do with mainland China going after those who think the Taiwanese do not belong to mainland China. Well, I see them as independent folks. Mainland China needs to stop thinking it can occupy land willy-nilly; unfortunately with USA, Russia and China thinking they can bully other countries that lack nukes, I think these smaller countries absolutely need nukes for defensive purpose.
It is also annoying that all these three countries think they can bully other countries too. That is basically them saying they can kill other people in other countries at all times no matter the real "reason" (just make up a fake reason, such as Russia with regard to Ukraine) - annoying to no ends.
Having said that, and I just pointed out I disagree with mainland China bullying the Taiwanese, I think it would actually be better to have software itself be completely apolitical. I never understood why people felt a need to tie political goals into software. That is a valid statement even if I happen to agree with the political goals here.
In 2026 hoping that software could be (more) apolitical is a very brave stance. I look at the software world and I can see core political statements in almost every popular software. From privacy invasion, supporting shady industries (e.g., marketing) even at the expense of people (a reverse-welfare, in a sense), environmental destruction (e.g., complete lack of care for resource usage) and many more.
If anything, we need much more politics in software, ideally exercised by those who write that software instead of "apolitical" software writers who end up executing the political software of those who pay them.
If you meant to scope your statement only to FOSS, then this still applies (in fact, FOSS is inherently political), plus I suppose some people who invest their time to write software want to also use the same effort for political activism and there is nothing wrong with that. This can be expressing their political views via that software (e.g., vim and the support to children in Uganda) or can be using a license that only allows co-ops to run their software, or many other ways.
The idea that software even could be apolitical stems from the idea that technology can be neutral, which again, in 2026 is really a tough idea to support.
Okay, lets go with your reasoning - software should not be apolitical/should be more political.
Where's the bar where you shut down discussion? I mean, even politics is contextual, right?
You entering a campaign about the plight of Myanmar and getting annoyed at people who don't want to hear your message about Gaza puts the blame for any conflict arising on that purely on ... YOU!
IOW, Even within political discussion, you can still be off-topic!
> If you meant to scope your statement only to FOSS, then this still applies (in fact, FOSS is inherently political)
Entering a GNU project (which has the political context of Copyleft and IP reform), and attempting to use it to spread a message about ICE behaviour still makes that asshole behaviour.
Only the most extremist true-believers feel that every platform is for their benefit. Trust me, it's not.
You are confusing being political with carrying out political discourse. They are not the same thing.
Being political for software means for example making some specific choices while designing it and advertising them as such. Means choosing a license over another. Means announcing political positions and possibly aligning the software to them (depending on what it is).
It doesn't mean going in forums related to that software to discuss random political topics.
> You are confusing being political with carrying out political discourse. They are not the same thing.
Okay, lets assume you are correct[1]; is that a counterargument to my main argument:
>> IOW, Even within political discussion, you can still be off-topic!
------------------------------------
[1] I don't think I am confused about the difference, TBH - I explicitly called out political preference of a project and political discussion within the project.
i always worry about tools like this, maintained by small teams, that are so universal that even if only a small fraction of installs are somehow co-opted by malicious actors, you have a wide open attack surface on most tech companies.
e.g. iTerm, Cyberduck, editors of all shades, various VSCode extensions, etc.
Similarly I worry about how these apps automatically update themselves. I know it can be done securely. I also doubt that these companies invest the engineering effort to do so.
It's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.
lol larger organizations don’t spend money on this, they add some useless ‘secops’ tools to their CI and call it a day. They are certainly not doing things like reproducible builds, lol half of them don’t deploy signature verification.
I've sat in some pretty large orgs and my own experience was the "resources allocated" went to the PR team. I can assure you that they would have had a more boring, corporate sounding announcement with multiple references to their legal team and the actions they would have taken, alongside some useless information about being PCI compliant or something. I'm not convinced the practical output is any better.
I don’t get it, why don’t you all—absolutely all of you reading—use Little Snitch? [1]
It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS ecosystem.
And this is not unique to macOS, this is all possible in Windows, Linux and any other OS.
The state of the world is such that I have started running everything inside VMs. Baseline OS install + virtual machine management and that is it. Which is still not immune, but makes me feel a lot better than core OS utilities are probably getting better vetting than nifty-utility-123 on which I depend.
It’s a false sense of security, more or less. If an application wants to talk to a C2 they don’t have to make a connection at all, just proxy a connection through something already allowed, or tunnel through DNS. Those juicy cryptocurrency keys? Pop Safari with them in the URL and they’re sent to the malicious actor instantly. If you’re owned Little Snitch does nothing at all for you except give you the impression that you’re not.
My example is “living off the land”, safari already has access to everything, open it and use it to communicate. Needs no permissions, bypasses little snitch entirely.
This is far too cynical of a take. LittleSnitch might not save you from well-established malware on your machine, but it will certainly hamper attempts to get payloads and exploits on your machine in the first place
It wouldn't protect against this attack though. The Notepad++ update servers were hijacked. Presumably you would allow Notepad++ updates through Little Snitch so you would be equally as vulnerable.
No, why would you allow automatic updates? It makes no sense. You should audit every update as if each payload could contain malware. It’s a paranoid way to live, but that’s what it takes.
We also need better computer science education in high schools, teaching students how to inspect network packets, verify SSL certificates, and evaluate whether a binary blob might contain malicious code.
People have gotten complacent about the internet, which is why they still get hacked, when it should be the other way around. With everything we’ve learned over the years, why are breaches more common than ever? I don’t understand why people are so careless about online security today, compared to decades ago when we were taught not to share personal information and not to trust anything on the internet.
Do you go by the smell of the executable or just general vibes? Nobody has never reviewed even a tiny fraction of the software they run, closed source or open source.
because i dont want to deal with constant whitelist management and i simply don't install applications i don't trust. if there's anything really absolutely essential or damaging if it were to leak i would not put it on a internet connected device to begin with
I used to love Zone Alarm's ability to notify me on an application's first attempt to connect to the internet, and allow me to approve or deny it. I really wish there was still such an interface today.
Having said that, I absolutely despised the implementation that stole keyboard focus; if it popped up when I was typing it frequently disappeared before I head a chance to read it and I had to go into settings to try and find what had changed. Nothing should ever steal keyboard focus unless it's urgent, and then it should website that you can't accidentally manipulate it with a keyboard (see UAC prompt where it opens in the background if the calling program is in the background, and where once you activate it, you have to hold alt+y/n or tab to a button before it accepts the input; just hitting the y/n key alone won't do anything).
The thought crossed my mind as well. Lots of typos, plus "old version compromised, use new version ASAP" could also be said to get people on a newly compromised version, right? Though it's probably just that the post author is stressed and rushed the post out. I do wonder if there's a way to verify the post was written by the real dev and that he still has control. Old known GPG sig?
>This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected
No, it should be a hardcoded key held by the developer, preferably using a HSM, and maybe with some sort of notification capability in case the key was lost. Adding a second server adds marginal security. For instance if the developer's mail was hacked, an attacker would likely be able to reset passwords for both hosting providers.
Previous NS records were pointing at dns-parking.com, which is Hostinger. Although hard to be certain without more details whether a reseller or other supplier is involved.
Every shared hosting provider has this risk. Critical projects should be using dedicated or VPS hosting, preferably with encrypted filesystems too as even datacenter techs can fall victim to social engineering.
I'm pretty surprised that they got away with unsigned updates and shared hosting as long as they did. I wonder how many similar popular projects are out there on dodgy infrastructure.
You’d be protected from this particular exploit if you used a package manager rather than the updater, though of course you’d still be vulnerable to the installer binary itself getting compromised.
Wonder how many packages in community package repos are compromised. Surely "Hubbleexplorer" can be trusted to provide arch users with a honest, clean version of npp.
Standard answer to a potentially compromised machine is to start with a factory reset machine and add the software and data you need to do your work/use the machine. Do not take executables from the compromised machine and use them any where since they too could be compromised.
There are more steps you can take to ensure greater safety. The above is the minimum a I do for myself and what the minimum IT department and my company executes.
I'm extremely wary about any application pushing politics.
I subscribe to MacPaw, who makes excellent apps like Setapp, Gemini, and CleanMyMac, all of which I use.
At some point, CleanMyMac started putting the Ukranian flag on the app icon and flagging utilities by any Russian developer as untrustworthy (because they are russian), and recommended that I uninstall them.
I am not pro russia/anti-ukraine independence by any means, but CleanMyMac is one of those apps that require elevated system permissions. Seeing them engage in software maccarythism makes me very, very hesitant to provide them.
Controversy doesn't change the reality. Stating that Taiwan is not independent is political posturing. Look to French Guiana, which is not independent.
Taipei only disagrees because they're under threat. Doublespeak should generally be called out. Taiwan lives under perpetual fear of occupation and forced assimilation.
if you're going to give in and avoid applications because, like in this case they take a strong stance on Ukraine or Taiwan the hack has literally achieved its purpose. Either silence the author directly or destroy its userbase.
Fuck'em and just donate ten bucks to notepad++ , I'd rather my pc breaks then reward this crap
I think I made it clear that I use (and pay for) their applications. I also think I made a sufficiently nuanced comment that doesn't suggest that I've "given in" to anything.
I can see where they got that idea from. You saying you won't provide permissions at the end ends up sounding a lot more like you won't use the app than I imagine you intended. (Although, subscribing to an app and then not using it would be silly.)
what I took a bit of offense with is the term "software maccarythism". That's a movement now remembered for an over-reaction to often imaginary enemies. Ukraine is right now fighting for its life in a hot war on our continent here in Europe. Taiwan is at the very real risk of being invaded.
American and European infrastructure is subject to cyber attacks that that are effectively hostile military acts already. I don't think a vocal stance on Ukraine and an exclusion of Russian developers deserves the rhetoric of McCarthyism or being 'too political' as is these days a fashionable accusation. This is no red scare, this is speaking up for people bombed on a daily basis.
It's also possible the update manifest contained an url that the updater blindly trusted, and by modifying that file you could change what got downloaded.
Notably Notepad++ was recently shipping unsigned/self-signed updates, apparently overlapping with the time of this incident, see releases 8.8.2-8.8.6: https://notepad-plus-plus.org/news/
Notepad++ is Windows-based and could use the Windows store instead of the built in updater. Microsoft charges a one time fee. It would pass SmartScreen checks. His website has a bunch of ads integrated which I assume are there to help pay for hosting.
Mr. Ho already has hosting charges and he uses GitHub. For those who use GitHub, he could continue his GnuPG method for signing. Additionally, GitHub integrates with Sigstore. Windows wouldn’t trust his signature but at least there would be better traceability. Version 8.8.7 labeled “authenticity guaranteed” is a step in that direction.
The real “issue” here was his outside hosting platform for updates from my reading of the article.
The lack of signing and/or checking the signature when updating is the real issue here. But the write up blames the attack on the hosting server. That doesn't bode well for future security.
So uhh... what exactly did the "state-sponsored actors" do?
They go on about how their server was compromised, and how the big bad Chinese were definitely behind it, and then claim the "situation has been fully resolved", but there is zero mention of any investigation into what was actually done by the attackers. Why? If I downloaded an installer during the time they were hacked, do I have malware now?
The utter lack of any such information feels bizarre.
> Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers. The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
Exactly... Were they exflitrating files open in notepad++ , or was notepad++ installing additional malware for system wide access? What was the end goal?
They were able to replace the downloaded executable with their own version. From the article:
> 2. Even though the bad actors have lost access to the server from the 2nd of September, 2025, they maintained the credentials of our internal services existing on that server until the 2nd of December, which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php to their own servers and return the updates download URL with compromised updates.
> Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated.
"The security exper’s analysis indicates the attack ceased on November 10, 2025, while the hosting provider’s statement shows potential attacker access until December 2, 2025. Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated."
Yeah, that refers to the MITM attack on the update server. We have no fucking clue what they actually did while they were in the middle - whatever exploit code was running may very well be running right now on compromised machines. Nobody knows what the compromised exes actually did.
Thanks for your nonanswer, though. It was about as unhelpful and unspecific as the original blogpost for this.
Download the latest version and install that, instead of using the auto update feature of an old version that might not properly check signatures.
As for whether anything else has been compromised, it depends on whether you were targeted. And the payload might have been tailored to each target, so there's no way to know unless you have access to the exact binary. Unfortunately, binaries downloaded through the auto update feature tend not to linger in your Downloads folder.
Disable auto-updates, just like you should with every piece of software on your machine. This was the result of letting other people silently replace your programs. Don't allow that.
Centralized automatic updates, like those of a Linux distribution or Microsoft's Windows Updates, involve giving permission to way fewer parties permission to download and run (unsigned, in the case of Notepad++ this time) code on your machine with high privileges.
And for more modern software distribution mechanisms (e.g., Nix, Guix, Flatpak), centralized package updates may not actually run any vendor code with high privileges at all.
The norm for proprietary software updates on Windows is indeed a free-for-all of every publisher downloading and running code with admin rights, and it is indeed a terrible way to operate. Avoiding that kind of madness doesn't necessarily mean running lots of old, vulnerable software.
> Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.
I'd be curious to know if there was any pattern as to which users were targeted, but the post doesn't go into any further detail except to say it was likely a Chinese state-sponsored group.
It might have been explicitly targeted, but they did say that there were older versions of Notepad ++ with ""insufficient update verification controls" so it might have just been there was only one subset of users actually susceptible to this.
No, the additional update verification was added after this attack was discovered. All Notepad++ installations were vulnerable during the time of the hijacking campaign.
Not notepad++!
(Opens WhatsApp)
OpenClawd express my discontent across all my channels and draft an email to send to IT tomorrow morning. Also turn off the lights off and go to bed.
(Somewhere in china, all the lights go out)
The whole approach of virus scanning is reactive and incomplete. This is because, except for some uncertain guesswork using "heuristics", it depends upon vendor analysis of submitted malware infection samples after it's already happened to determine specific malware file/process signatures. This doesn't and cannot catch all possible malware that has ever happened, especially if it's new, not widespread, or evaded analysis from ever being noticed. Thus, a fraction of malware will always slip and will always remain undetectable.
After a machine is compromised by malware, there's rarely-to-never a trustworthy way to ever fix it with 100% certainty. And especially worrisome is "repair" from the host itself which maybe infected with a rootkit that hides and repairs the malware. Thus, the only correct solution is to completely reimage/reinstall from trusted sources. Deviate from this path at one's own extreme cost/risk.
There also exist a tiny amount of even worse, specialized malware, usually deployed by state actors, that infect hardware in such a way that makes them difficult and sometimes uneconomical to repair.
PSA: Never run untrustworthy shit on any machine that matters. This also includes FOSS projects that don't have their shit together.
Most edr has a “this program is doing something bad” detector. But the number of folks running security on their build process is still not ubiquitous.
No, it's specifically the updates that were targetted. I'm unsure about the downloads but those too are presumably at risk.
> The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
Vindicated once again for turning off any update checks the moment I install any new piece of software.
Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location based on the set of software you have installed, all of which want to check for updates every goddamn day.
If the people with access to Room 641A want you, you're toast unless you're ready to make some REALLY big digital lifestyle changes that most people would not be amenable to, because you would have to be extremely paranoid on multiple fronts all the time. That kind of heightened vigilance is exhausting and really not worth it.
Sorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you.
I once worked at a company where the Security team were very proud of this and all the other tricks they used to catch leakers by figuring out who was on campus, where, at what time, usually via fingerprinting personal devices carried alongside corporate devices.
Ah, so, in addition to turning off automatic updates (everyone knows patches are for wimps! The real threat is supply chain compromise, not 1-days!), you also have taken all of the other necessary steps to protect yourself from the NSA? What if they just compel Microsoft to backdoor Windows/WinGet against you?
And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, and even that's going away...?
> What if they just compel Microsoft to backdoor Windows/WinGet against you?
You are confusing cause with effect. Leaking this type of fingerprint data over time is what allows users of Palantir-like systems to decide you're somebody worth individually targeting.
It is baffling to me, as well. You know how you get a remote-code-execution vulnerability? You give a bunch of software permission to fetch code remotely and execute it.
At least JS code in a browser is sandboxed. A Notepad++ update is just rawdogging an executable on your bare metal, perhaps with admin privs even, and hoping for the best.
First, it wasn't even the developer who compromised people, here; second, scripts in most cases are orders of magnitude less dangerous than a windows executable.
And, in many cases you can get some protection from a developer going rogue (or not writing perfect code), it's not an all or nothing.
I use a package manager that checks the hash of the downloaded installer against what's recorded in the package listing for that version. WinGet has been built in to Windows since one of the 2018-era releases of Windows 10: https://i.ibb.co/VYGXdc56/2026-02-01-20-46-28-Greenshot.png
Integrity checks say nothing about the package authenticity, though. State sponsored actors could just... change the hash on the listing in a hypothetical attack.
That would be two things that would have to be compromised and redirected simultaneously to malicious versions. Way more likely to be noticed too because one of them would be GitHub, and unless they mirror the entire rest of the package metadata index and keep it up to date for everything else besides their targeted malicious package.
So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?
Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start? Though I would assume these malicious updates would be clever enough to rather have dropped and executed additional files, rather than doing something with the Notepad++ binaries themselves.
And I agree with another comment here. With all those spelling mistakes that notification kind of reads like it could have been written by a state-sponsored actor. Not to be (too) paranoid here, but can we be sure that this is the actual author, and that the new version isn't the malicious one?
This reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it.
I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at the problem statement.
I still think I'd like to have a web of trust system where I let my friends try out software updates first before I do, and my relatives let me try them out before they do.
Ah, I remember those days. One that wasn't an error exactly was an assignment that had a word limit of 2000 words or something. I'd written maybe 3000 words and spent quite some time cutting it down, getting it to just under the limit. Then someone else who also wrote too many words asked the professor if that was okay and they sent out an update to everyone saying it's fine to ignore the word limit.
I work in a lab as an analyst (bioinformatician), we are register and pay for quality assurance programs that contain an embarrassing about of technical errors.
>I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?
Notepad++ site says The incident began from June 2025.
On their downloads page, 8.8.2 was the first update in June 2025 (the previous update 8.8.1 was released 2025-05-05)
So, if your installed version is 8.8.1 or lower, then you should be safe. Assuming that they're right about when the incident began.
edit: Notepad++ has published, on Github, SHA256 hashes of all the binaries for all download versions, which should let users check if they were targeted, if they still have the downloaded file. 8.8.1 is here, for example - https://github.com/notepad-plus-plus/notepad-plus-plus/relea...
Just checked my 8.7.9 that I installed in April 2025 and never updated. The hash seems to be identical to the version I installed around that time. Seems like it was a good choice to always skip the Update Dialog when using Notepad++ lol.
> And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start?
Did I understand the attack wrongly? The software could have a 100% correct checksum, because the attack happened in a remote machine that deals with call home events from Notepad++, I guess one of those "Telemetry" add-ons. The attackers did a MITM to Notepad++ traffic.
The remote machine that was compromised was responsible for Notepad++ updates, so the concern is that it could cause a compromised version of the software to be installed. But if it could do that, it could probably cause anything to be installed anywhere on the user's machine, so inspecting the installed N++ binary probably wouldn't be too useful.
Checksums are useless in this case. The binary would have to be signed and the installation routine would have to check that the new binary would have been signed with the certificate. That adds complexity, but would have thwarted this specific attempt.
However, there are ways around this, too. No solution is perfect.
> So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?
Is this surprising? My model is that keeping with the new versions is generally more dangerous than sticking with an old version, unless that old version has specific known and exploitable vulnerabilities.
Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that running an old software version. Try exposing a windows XP to the internet and watch how long it takes before it‘s hacked.
> YouTuber Eric Parker demonstrated in a recent video how dangerous it is to connect classic Windows operating systems
The video referenced in that article explicitly connects directly to the internet, using a VPN to bypass any ISP and router protections and most importantly disables any protections WinXP itself has.
So yeah, if you really go out of your way to disable all security protections, you may have a problem.
I hate that. “Bug fixes and improvements” every time. And then there are the ones who think they’re being cute with “our bird Fernando has been hard ar work eating those nasty bugs and flying over the rainbow to bring you an ever delightful experience”. Just, no. I don’t mind you flexing some creative writing muscles in your release notes if you provide actual clear information, but if you’re going to say nothing like everyone else, might as well use the same standard useless message so I can dismiss it quick.
It depends if the application itself touches the Internet or only when conducting updates.
The threat model for a server and for a personal computer are very different. On a consumer device, typically only the OS mail app and browser have direct contact with the outside world.
To be fair I doubt there are that many people scanning for internet facing XPs in 2026.
On the other hand, any server running old, unpatched versions of apache or similar will get picked up by script kiddies scanning for publicly known vulns very, very fast.
The notepad++ attack is politically targeted and done through unconventional channels (compromise in the hosting provider). I don't think 99% of the people reading this thread has a comparable threat model.
Steve from Security Now podcast has been specifically using Notepad++ as an example of not being able to leave good enough alone for years now. Can't wait to hear him claim his told you so next week.
"So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?"
This is true for a large number of software "security" issues
A software version earlier in date/time is not necessarily inferior (or superior) to a version later in date/time
As it is "updated" or rewritten,, software can become worse instead of better, or vice versa, for a vaariety of reasons
Checking software's release date, or enabling/allowing "automatic updates" is not a substitute for reading source code and evaluating software on the merits
I disable auto update for everything that does not have direct contact with the Internet otherwise (mail app, browser, OS, router,...).
Probability for some random app being exploited because updates were skipped is insignificant compared to the probability of a malicious update.
Updates are a direct connection from the Internet to your computer. You want to minimize that.
> With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed.
I get that this is a difficult situation for a small developer, but ending with this line did not fill me with confidence that the problem is actually resolved and make me trust their software on my system.
That's the most honest assessment you can expect from any small-scale developer. What do you expect them to say or do? Their adversary is presumably a national intelligence agency of a superpower.
The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be.
Binaries or source, it's pretty much the same unless you thoroughly vet the entire source code. Malicious code isn't advertised and commented and found by looking at a couple of functions. It's carefully hidden and obfuscated.
> The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be.
I mean, if you look at the Notepad++ website this developer seems just as concerned at spamming political messaging all over everything as much as he is with writing the software he's distributing. It's pretty crazy he apparently didn't think to take more basic precautions given he is basically permatrolling Russia and China with his messaging. Big brain moment for him. And meanwhile, after reading that disclosure nonsense none of us even know what's going on - like, should we be formatting machines that were affecting during that timeframe? Was the attack targeted and specific only? Who the fuck knows!
First, you're getting upset at a random person on the internet for expressing their political views. Second, your objection almost certainly has nothing to do with this attack. It targeted some specific subset of users of Notepad++, not the maintainer.
You think the developer/publisher/maintainer of software as ubiquitous as Notepad++ is some 'random person on the internet'? Or are you referring to the commenter I was replying to?
I definitely am not upset at the commenter I replied to, and while I'm definitely upset at the maker of Notepad++ I don't think he qualifies as some random person on the internet. If you publish software that security conscious people use (and certainly Notepad++ is used by tech savvy security-conscious people) then you, really by definition, aren't some random person - that's kinda the whole point. Security conscious and tech savvy people tend not to install things from random people on the internet.
Notepad++ was a trusted website/trusted developer, and they got caught with their pants down doing some truly dumb and lazy shit, and then they published a blogpost that doesn't explain much of anything. So yeah, that's pretty infuriating my friend.
It looks like using Chocolatey [1] saved me from this attack vector because maintainers hardcode SHA256 checksums (and choco doesn't use WinGuP at all).
I don't think "we" would have been impacted since this specifically targets the updates, but recently Microsoft pulled Notepad++ from the list of apps we can use on our production management laptops. Some people were annoyed and whining about this. That predated this announcement by a few weeks. Probably the right move by the security folks.
I've been thinking a lot lately about open source.
It seems to be a lot like the communism - sounds great on paper but we are yet to see a proper implementation.
Between GIT, Linux and SQLite there are a few projects that has been led by weirdos that have time, resources and conviction to drive these through time.
Unless you create some sort of a an auxiliary business and get an acquihire deal most things will fizzle out.
Years ago when I started working for BigCo I was amazed by their denial of FOSS. At one point in the project I pointed out a problem, which was heard and recognized, to which I followed up with a solution using an open source package. I thought I was clever - we needed an extra package in our system, but I was able to find a suitable open source solution that would not add to the overall cost of the project. My proposal was immediately pushed back.
Initially I thought it was due to responsibility issue - if we'd employ a FOSS solution we'd be responsible for the outcome. Having a 3rd party vendor the management would have the opportunity to shell themselves.
But that doesn't have to be the case. The FOSS project could easily fizzle out. And if we don't have enough resources to incorporate it and make it our own, we can potentially risk being left out to dry.
> Unless you create some sort of a an auxiliary business and get an acquihire deal most things will fizzle out.
This is acceptable. Why shouldn't most things started by people not willing to put in the work to keep them going not fizzle out? The important thing is that anyone who actually cares to can jump in and pick up right where the open source software fizzled out and get it going again. Anyone can learn from the code and use it for anything they want, even things that have nothing to do with the goals of the original project.
It's not as if there aren't countless examples of corporate vendors dying off and leaving their customers on the hook with nothing, or just changing the product drastically after the sale. At least in the open source case you have the option to fork the project and continue using it as you always have.
For a while, I've been thinking that open source package portals will at some point take over making of binaries that get released. Dev teams will run their own CI with whatever automated test pipelines they think is appropriate. For a tests-pass situation and will pass the git hash to the portal system for release, which just runs compile and making the binary. Well, not all CI runs would result in a release, of course. Then the package portal's own software kicks in to calculate an independent since-last-release report that's attached alongside the maintainer release notes.
All such portals upgrade their hash/sig noting of binaries, and keep those in a history retaining merkle tree of sorts. Of nothing, else a git repo. Something like this https://github.com/hboutemy/mcmm-yaml/blob/master/aws/sdk/ko... but with SHA256s, and maybe not the entire world on one repo.
That's sad. China should be more helpful with regards to open source.
Notepad++ is a great editor. I don't use it on Linux, because I have
an older editor I am very used to, but on Windows I like notepad++
a lot (though lately I have been using geany on Windows, mostly
for convenience - I think notepad++ is better but I sort of like
the github-based development of geany; either way notepad++ is
really excellent as well).
This time I unfortunately have to move on from Notepad++. Vibes have been negative for a while but out of inertia (and because there weren't obvious alternatives) I never pulled the trigger. Now it's time. The trust is gone.
Thanks NP++ for being free and useful for so many years.
Can anyone suggest a solid alternative on Windows? I'm fine with Linux and macOS but I have to keep a Windows machine around for some legacy, win only, software.
Maybe Sublime Text could be an option? At this point I'd rather pay for something lightweight, fast, and probably better.
I don't like tooling that increases my exposure to bad state actors (whatever state they're from).
Many large companies allow employees to install software from the internet on their work laptops. How do they avoid being regularly hacked this way (presumably NPP is far from being the only one at risk, and presumably the money from theft of corporate secrets attracts skilled and motivated hackers).
Well, the update in Notepad++ was the single annoying thing and I made sure I turned it off as the first thing after the install. It was terribly annoying, interrupting my workflow every often so I have no idea how others managed. Why should it decide when to upgrade anyway? It's a notepad! Why should I even bother to upgrade? Everything I need is already there! A piece of software like this one shouldn't be allowed to send out traffic by default anyway, it should be opt-in.
You should see the apps on MacOS. Almost every single app that is not installed from Appstore has that shitty update popup, it is driving me nuts.
I think Linux has the best solution for this - good package managers for bases system and Flatpak with Flathub repo for other apps. So you never get stupid popups, and update managers use signed packages and check those signatures before installation.
I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this.
Absolutely no reason a text editor needs internet access.
I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.
A browser can download updates and plugins to be installed locally. I too do not want all my apps making internet connections. Sandboxes / namespaces can help a little.
I think these days updates through the OS package manager is a better option, windows has had winget for 5+ years now, and obviously linux and macos both have their own established systems.
It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.
Why am I hearing about that specific FW in year 2026, this seems really good, at least the features written if it really supports rules based on parent processes, wildcards, SvcHost granularity without gotchas.
Been wrangling with Windows FW for ages, trying to get some badly behaved programs to update like Discord, Teams and others that change install paths or updater executable names or hiddenly use msedgewebview2.
PolicyAppId and tagging based rules have given some success but Windows FW is still really broken. Definitely giving Fort a try.
LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made
> LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made
For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done.
I use LuLu, it works great. Its kept my older versions of Photoshop and Acrobat from complaining and showing me ads for newer versions for the last couple years!
Yeah I've been using Fort on windows, it's easy to use and not closed source and full of bloat like the commonly suggested windows firewalls from various security companies.
This is where package managers shine. You never know if there are vulns in the update servers, and you don't know if they even bother with checksums. I never trust apps that self-update for exactly this reason. Turn that shit off and do
choco update notepadplusplus
or
winget upgrade Notepad++.Notepad++
Of course, this does nothing for bugs in the code.
thisislife2 | a day ago
N_Lens | a day ago
dgrin91 | a day ago
digdigdag | a day ago
hsbauauvhabzb | a day ago
mapontosevenths | a day ago
https://www.heise.de/en/news/Notepad-updater-installed-malwa...
https://doublepulsar.com/small-numbers-of-notepad-users-repo...
The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices.
The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia.
Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.
metalcrow | a day ago
tgsovlerkhgsel | a day ago
> Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“
It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.
kevin_thibedeau | a day ago
lukan | 20 hours ago
mapontosevenths | 17 hours ago
idiotsecant | a day ago
PixyMisa | a day ago
g-b-r | 23 hours ago
simlevesque | a day ago
icelancer | a day ago
lobito25 | a day ago
chvid | a day ago
How do they know it was a Chinese group or even a state sponsored one?
cwnyth | a day ago
skeledrew | 16 hours ago
cwnyth | 9 hours ago
uhx | a day ago
somenameforme | a day ago
lukan | 20 hours ago
tbrownaw | a day ago
rightbyte | 21 hours ago
LoganDark | a day ago
When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task.
I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.
I almost always see activists using the argument that if I don't like the messaging then I'm part of the problem. Somehow I doubt that, given I don't mind messaging at all, where it's appropriate.
icelancer | a day ago
ryandrake | a day ago
LoganDark | a day ago
suprstarrd | a day ago
I see this as a bad analogy though: you wouldn't hear about it every time you go to the grocery store. Or, at the very least, you wouldn't stop and listen for the fifth time. You already know, and that's the point: the intention of most activism in technology (at least that I see) is to make you initially aware of it so you start to seek the information out and learn more elsewhere. (...And to give themselves good PR. We love rainbow capitalism /s)
Instagram and Twitter both get your attention during election season because they want you to be informed about how to vote. To me, that's a similar thing.
davorak | a day ago
I considered the majority of the population to be affected by repeated messaging, messages in the background, or in other words availability bias. So the messaging be having the desired effect on society in general but not on some subset who filter it out completely.
LoganDark | a day ago
davorak | a day ago
Something similar, significantly different though, happen to a friend. They started distrusting the incogni.com after seeing their advertisements over and over again. To them they saw/felt/reasoned that only an untrustworthy actor would be pushing the messaging so much and a trustworthy actor would rely more on word of mouth via their good product inspiring people to speak up about them. I had to point out that they probably saw much more of incogni's advertising due to their rate and type of media consumption and most people probably do not get that level of exposure. If incogni lowered their advertisements to hit them correctly it would not be nearly enough advertising to reach the average consumer.
I see the frustration at the repeated messaging to likely be a natural protective mechanism. Instinctively reject repeated messages is not necessarily a bad instinct since manipulative people will use repeated messaging to manipulate, but repeated message exposure does not only happen due to an attempt to manipulate.
Der_Einzige | a day ago
I don't want to either, and indeed I really want others to do it for me. As such, I really want to see even MORE political stuff like this to hopefully create folks who will actually protest and put their neck on the line.
Similar reason why US military propaganda is good. I never EVER want to be drafted and indeed if you put a gun in my hand and military fatigues on me, I will die with a shot in the ass (because I am running away). Thankfully, we have a bunch of hardened 20-somethings "manipulated" into joining the military and protecting us so that I can be lazy.
So please ratchet up the politics and get others out so I don't have to. It's not that hard to ignore yet another plea for help. We do it every hour of every day.
eloisius | a day ago
lelanthran | 20 hours ago
1. I don't want to see political messages in unrelated delivery mechanisms
and
2. I created $PRODUCT as a delivery mechanism for a political message
are equally valid.
I feel that the problem that comes about is when a $PRODUCT was not created as a delivery mechanism but is being co-opted into being one at some later stage; the audience feels deceived and the creator feels that the audience is ungrateful.
I'm not very familiar with Notepad++ (having never used it, nor experienced any desire to try it), but I'm fairly certain that the creator has been political long enough now that the audience cannot complain about the message being delivered with the product.
It's like complaining about Vim having a message for the plight of Ugandans - it's been there for decades; too late to complain now about it.
I'm more sympathetic to complaints over projects which never had a specific political message suddenly acquiring one when they realised what a large audience they had, or when new people join a decades-old project and introduce a political message that was never there before. I can sorta understand outrage then.
viraptor | a day ago
direwolf20 | 18 hours ago
Conveniently, it's never here, and it's never now. I think MLK Junior wrote a speech about this? Letter from a Birmingham Jail: https://www.africa.upenn.edu/Articles_Gen/Letter_Birmingham....
Aeglaecia | a day ago
idiotsecant | a day ago
davorak | a day ago
I do not think it is uncommon for someone to do this, then see the side they oppose win more in elections, public perception, etc then decide to engage more and that is "why is there political messaging literally everywhere".
Since we can't remove it, the next best alternative is to participate and advocate for responsible political engagement. I think until we have some shared understanding of what responsible political engagement is we will continue to have it everywhere.
Aeglaecia | a day ago
iamnothere | a day ago
Edit: I’ll also add that political messaging is highly contextual. What is appropriate and effective in one place may be counterproductive or actively harmful elsewhere. Format and tone actually matter if you care about your pet cause succeeding, believe it or not.
Fogest | a day ago
I view these kinds of weird virtue signaling political statements on things like software to be the same. They do absolutely nothing and are just visual noise for nothing. Actually, this is a good example of where it can go wrong as it likely made the software the target of Chinese state-sponsored actors. So not only does it serve no useful purpose, it also can make you a target and piss people off.
stirfish | a day ago
LoganDark | a day ago
jajuuka | a day ago
It's okay to watch a show about knights and demons and enjoy it. It's okay to use a piece of software that doesn't code every release as a protest against something. Instead of judging other people for not burning out, maybe take a break yourself. It's okay and normal.
subsistence234 | a day ago
Yes you can.
>I have transgender friends who fear for their life every day. [continues]
That's hysteria.
umcill | 10 hours ago
direwolf20 | 18 hours ago
esperent | a day ago
So, while I fully agree with your stance that banning political discourse is support for the status quo, I also think that it's reasonable to ask for it to be toned down a bit, especially when the politics and social issues of one country is basically drowning out everything else.
All that said, I'm talking mostly about HN or other community forums here. The owner of Notepad++ has the right to put whatever they want into their software, and if we're discussing that here on HN then it's an occasion where discussing politics is valid.
shiroiuma | a day ago
LoganDark | a day ago
FormerBandmate | a day ago
I don’t agree with them and I don’t think they should be in my software, or dealing with anything they don’t understand (for instance crime, homeless people, geopolitics, or really anything outside of overpriced vegan coffee shops). All they really do is end up getting Fox News people to vote for fascists like Trump out of spite
autoexec | a day ago
Activism can be annoying, but it's never pointless (not even when it fails to be effective).
> All they really do is end up getting Fox News people to vote for fascists like Trump out of spite
It wouldn't be worthwhile for activists to resign themselves to inaction out of fear of offending the "Fox news people". "Fox news people" are already more likely than not to vote for fascists like Trump, and they'll use any excuse/justification they're being fed including "I don't like the way the wrong people are using their freedom to protest the wrong things".
moi2388 | a day ago
When I care about politics I’ll deal with actual politics. Reddit won’t change my mind nor the world.
joe_mamba | 20 hours ago
LoganDark | 5 hours ago
For example it's very normal for the Tor project to talk about censorship and privacy. It's also fairly normal for Russian maintainers to speak out about how it's no longer possible for them to receive support due to sanctions. And I can understand if a Ukrainian maintainer has to focus on trying to survive or escape the country instead of developing their software. All of that stuff is completely fine and I wholly empathize with it. It doesn't bother me because it's not extraneous; it is directly relevant to the project. I also don't mind projects listing their preferred charities.
But I do roll my eyes when projects continue to pine on about Taiwan's independence or the genocides in Gaza. If there isn't a reason why it's actually relevant to the project, I don't think the project page is a good space to push it.
user205738 | a day ago
Yes, yes, and yes again.
> Many activists would certainly have you think otherwise. As far as I can tell, fighting that habit is a huge goal of activism.
That's their problem. As soon as you start contributing to them, you will not pursue your own goals, living your own life, but those imposed by activists or their supervisors.
It's convenient for them, you give them a political resource. But why do you need it?
appreciatorBus | a day ago
Activists wanting something is not synonymous with that thing being a good idea. It just means that someone wants something out of you could be good, could be very bad. No different than a sales person trying to get you to buy something.
shiroiuma | 6 hours ago
No one has the time to pay attention to every little injustice in the world. For all the people crying about Gaza, how many of them are dedicating as much energy to the wars in Sudan, Yemen, or Myanmar, or the abuses by Russian security services (like imprisoning a guy for holding up a blank card)? This isn't to say that we should just ignore Gaza or Ukraine or ICE in the US, but we need to make a choice: either we spend ALL our energy addressing every injustice in the world, until there is no more injustice left (and this means we need to stop everything else we're doing now, including keeping society running, making food, etc.), or we need to choose when and how much attention we'll devote to various issues.
LoganDark | 5 hours ago
appreciatorBus | a day ago
devkit1 | a day ago
esperent | a day ago
vjvjvjvjghv | a day ago
Try to point out to a democrat that Trump is doing something right or to a Trump voter that Biden did something right. Most of them can’t accept that. The “other” side has to all bad. I don’t see this to such an extreme in other countries I know like Germany or Spain.
andyferris | a day ago
If in another country I vote for these guys or sometimes those other guys, and once this little party that got a seat, but not really those ones, and I really hate these ones, then your "political identity" already has a lot of nuance. In Australia with preferencial voting, a single vote has a lot of naunce.
What can you get in America? Green Party supportors who "strategically" vote for a democrat? Not much else...
nottorp | 22 hours ago
It has been like that since forever. They don't know how a left leaning party looks.
tjjuckson | a day ago
could you remind me what country is the afd based out of thnx
defrost | a day ago
By all means make a considered and thoughtful point, please.
faust201 | a day ago
In reality it is not. It is a spectrum of parties. People vote often for smaller parties in the state and larger ones in the national.
direwolf20 | 18 hours ago
anticodon | 23 hours ago
If tomorrow there would be a war or protests in, say, Burundi. Will Americans stay with Burundi or against it? Or with the country the media will tell them is "good" because their interests align with US interests?
I think answers to all these questions are obvious.
esperent | 23 hours ago
bsder | a day ago
Unfortunately, US politics also drives tech issues elsewhere like the EU. For example, local data control is a big thing that some of us have been screaming about forever but nobody paid attention to--until US politics made it a hot button issue.
And, to be honest, if the EU would get off its ass and at least try to foster some alternatives, even those of us in the US would benefit. EU alternatives would mean that people in the US could finally vote against the megajillionaires with their wallets.
> Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics.
Bullets and beatings don't leave much room for nuance regardless of country.
joe_mamba | 20 hours ago
What exactly do you want the EU, the Brussels based institution, to do here? Because AWS didn't come into existence because Uncle sam came in and twisted Bezo's hand telling him to invent a hyperscaler that will conquer the world.
EU's lack of comparable domestic alternatives is a consequence of the failure of its entrepreneurship and free market in the SW private sector, and nothing that EU institution can do about it to magically fix this since the solution is not MORE regulatory interference form government bureaucrats who don't know how the internet works.
You might be able to force innovation if the governments can throw money at the problem if the VC sector is lacking, but they can't force economies of scale and mass adoption without a China style great firewall, in which case you'd then have even bigger issues.
direwolf20 | 18 hours ago
Capitalists can also start software businesses and sell their software, but those are all in Silicon Valley because the money is there because the US has a privileged financial position.
bsder | 5 hours ago
Well, gee, let's look at the sponsorship page for KiCad: https://www.kicad.org/sponsors/sponsors/
I see a couple EU companies, but no EU governments. It takes a paltry $15K to be a Platinum sponsor.
I picked KiCad because PCB design is critical military infrastructure, the alternative programs are almost all under non-EU jurisdictions and could be pulled, and KiCad is both open source and local desktop to top it all off. This is exactly the kind of quiet, unflashy toil that desperately needs support from a government entity.
Lots of areas need support for open source alternatives that are controlled by proprietary software that might vaporize. I picked PCB design because it's an easy target. Cadence and Synopsys have locks on VLSI design domains that could get yanked from the EU. VHDL tooling is still disastrously poor. Everybody could use an alternative 3D modeling kernel (the EU is a little better here because the dominant proprietary kernels are from Dassault Systèmes and Siemens). I'm sticking to software as the domain because the purpose of the funding is obvious (pay developers, duh), but it also applies to things like small manufacturing and maintaining domestic supply chains (but the purpose and focus becomes a lot messier).
And yet, everywhere I look, any project I pick, crickets.
I don't expect the EU to front run, but something like KiCad is 3 bloody decades old.
> those are all in Silicon Valley because the money is there because the US has a privileged financial position.
And yet you had the rise of Akihabara as an electronic parts mecca which then later got eclipsed by Shenzhen. And that's not even talking about the fact that the modern computing sits atop a mountain of stuff developed out of the VLSI Project (https://en.wikipedia.org/wiki/VLSI_Project).
All of those occurred because their respective governments threw money around.
Sure, maybe you won't create another Silicon Valley hare, but, perhaps, just perhaps, you might create a relentless, open source EU tortoise that slowly displaces the proprietary software. The EU is good at slow--relentless, not so much.
Sadly, a continual state of inertia and sclerosis and failure around tech seems to be historically European: https://www.phenomenalworld.org/analysis/the-eurochip/
globalnode | a day ago
direwolf20 | 18 hours ago
lenerdenator | 15 hours ago
I mean, yeah. Most major social media services used in the West are based in the US. The single largest English as a first language population is in the United States.
Given how many users from outside the US are oft wont to opine on our state of affairs even during the good times - often without even being asked - I like to think they'll endure our discourse.
nonameiguess | 15 hours ago
getnormality | a day ago
Political opinions about how things should be don't automatically dictate the actions that should be taken in support of those opinions. I can be mad about a law or a court decision and still have the good sense to, for example, not throw red paint on a lawmaker or judge.
Some behaviors just aren't helpful, and neither being right nor being upset changes that.
popalchemist | a day ago
defrost | a day ago
As problematic as the assertion "by definition" is aside, it should be noted that endlessly commenting about politics on internet forums effectively changes nothing.
I've been kettled by mounted officers and hit by high pressure hoses on cold evenings, something that also rarely effects change .. but that's a least a fun night out with people and better than wasting bits on the intertubes.
popalchemist | a day ago
But if I were a nihilist I might agree with you.
defrost | 20 hours ago
When last we crossed you appeared to be lecturing people while incorrectly paraphrasing their actual position (aka strawmanning)( https://news.ycombinator.com/item?id=46793399 ).
FWiW I recall handing a guitar (I hear they kill facists) to Billy Bragg way back when he was on tour Talking to the Taxman About Poetry and FYI he's back, again, following Springsteen: https://www.youtube.com/watch?v=IKOW2ZikGW8
So, good luck https://www.youtube.com/watch?v=NJ2QOwQdHL8
Maybe sidestep becoming a parody: https://www.youtube.com/watch?v=W1_uEbGJtnY
popalchemist | 12 hours ago
bigstrat2003 | a day ago
popalchemist | a day ago
direwolf20 | 18 hours ago
fc417fc802 | 5 hours ago
da_chicken | a day ago
Notepad++ is free, open source software for which there are dozens of alternative packages of equivalent quality. The entire cost of using this software and benefiting from the work of the developer, is having to scroll past or close a few political opinions.
If the reaction, if someone vehemently dislikes this sort of thing, is to tell that developer to "just shut up and make your software" rather than to stop using that software? Then I think that's possibly the most entitled and hypocritical position that I think it's possible to have.
getnormality | a day ago
ImPostingOnHN | a day ago
viraptor | a day ago
The good sense is your judgement. At some point a real, direct, disruptive protest is going to be the right solution for a big enough group of people. Peaceful protests are just a "we're starting to get there" signal. It's not like politicians normally say "gee, lots of people don't like how I abuse power, I guess I'll stop now". It's all about being collectively upset enough about status quo.
b65e8bee43c2ed0 | a day ago
no one is telling you terminally political folx to cease all political messaging on the internet, you're just being told that this is a Wendy's.
96% of the world are not American.
@dang does it only take a single poweruser to flag a comment now?
dymk | a day ago
b65e8bee43c2ed0 | a day ago
direwolf20 | 18 hours ago
joejoe638 | a day ago
The politicisation of software is as harmful as requiring every research paper to be published with a political allegiance banner.
Software like most Sciences, Engineering, and, Trade is a much longer game for humanity than politics de jour.
It is easy to forget the extent of contributions from all sides of politics that has contributed to this trade, from Mohammed Algorithm to English, Russian, Chinese, and, everyone else to computing; but forgetting that and forging that for quick political hack points is a disservice to humanity.
pixl97 | a day ago
Not really, software, like sciences and engineering must survive politics first. If humans start tossing around nukes like angry apes then those that survive may be scratching simple arithmetic with a charcoal stick on a cave wall.
joejoe638 | a day ago
Additionally, it is based on a false notion that political banners in software helps in pursuing anyone let alone change political outcomes.
deathanatos | a day ago
Further, political banners in software have absolute helped, and have changed political outcomes. As an example of that, SOPA, and later PIPA, were defeated by websites such as Wikipedia (which are software) putting banners aimed at informing the public of those bills.
[1]: https://en.wikipedia.org/wiki/Szil%C3%A1rd_petition
joejoe638 | a day ago
This is the entire point and objection with politicisation of everything.
Orygin | 18 hours ago
Feels like this is overstating the facts. Afaik, twice did the author on N++ did include a small political message in a release.
Is it really "whenever"? Blowing this out of proportions because some are so allergic to any political message that twice in 10 years is being pushy..
In the end, everything involving more than 2 humans is politics. You may want to ignore some topics, but those may be important to others. Until the day you yourself want to bring some attention but you're met with an "apolitical" response saying it's not the time or place for it.
joejoe638 | 13 hours ago
gruez | a day ago
Before I respond to your comment, allow me first to acknowledge the following injustices happening in the world:
* war in gaza
* war in ukraine
* civil war in sudan
* civil war in yemen
* civil war in myanmar
* ethnic violence in syria
* insurgent attacks in nigeria
* insurgent attacks in congo
* attacks on protesters in Iran
...
Wait, what's that? You don't want every comment to start with some sort of land acknowledgement-esque disclaimer of all injustices happening in the world? What are you, some sort of gaza war/ukraine war/sudanese civil war/ ... sympathizer? Tens, if not hundreds of millions have been affected by the event listed above, so at the very least you can spare a thought for them before discussing about some text editor getting compromised? You might argue acknowledging the war in gaza is beating a dead horse, but do you think the median HN reader has thought about the civil war in myanmar in the past month?
p_ing | a day ago
In the context of forums, the political threads are generally /not interesting/[0]. Political threads often devolve; they bring nothing 'new' or 'fresh' to the table, and they lead absolutely no where. It's a fart-in-the-wind situation no matter what your position is. Leave that stuff on reddit where the rest of the farts-in-the-wind go to waste. It's like watching commentators on Fox News or CNN or <insert favorite cable TV show here>. They're a large waste of time and they're often geared towards re-enforcing your side, aka echo chamber.
Now, if a thread actually evolved into real measurable action, that might actually be interesting. But that's not what happens on these forums. There's probably very few of us that see some HN thread talking about something awful happening somewhere and they take direct action, such as petitioning their government, protesting, etc. It's probably happened once or twice, but most of the farts in those threads just hang around and stink up the place.
Please stop stinking up HN.
[0] https://news.ycombinator.com/newsguidelines.html
NuclearPM | a day ago
joejoe638 | a day ago
Your comment is a good example of it; who is dictator? The people who hacked the software or the political pole they support? At what point did they become fascist enough to warrant politicalisation of everything ?
direwolf20 | 18 hours ago
eunos | a day ago
We are all Schmittian now
chii | a day ago
apparently, it's OK to have this stance of "if you're not with us, you're against us".
It's absolutely possible to not want political discussions in various places - it doesn't mean you support one or the other side. It simply means you don't want that discussion here. You could support the incumbents or not - not wanting the discussion does not imply support for the incumbents.
direwolf20 | 18 hours ago
tjwebbnorfolk | a day ago
There is such a thing as being able to act and think in ways that aren't political in nature. Maybe not for you, but it absolutely is possible.
anonymous908213 | a day ago
Politics are quite literally life-or-death for many people. War is politics. Access to healthcare is politics. Economic policy that determines whether businesses and careers succeed or fail is politics. Freedom to say what you want, believe or not believe in whatever religion you want, and be who you are without being imprisoned is politics. The people who make the most noise about politics are the people who are literally dying for as long as the rest of society ignores their plight.
If this isn't the case for you, it's because you benefit from the status quo. It is the definition of privilege to be able to "ignore politics". That means you are currently benefitting from politics. Of course you don't want to hear about politics, politics are doing just fine for you. And the comment you were asking to was asking you to reflect on that: if the biggest problem gracing you is hearing other people make noise about circumstances, the least you could do is deal with it. Your problems are trivial if that is what gets you upset. Other people are complaining about things that affect the outcome of their lives and you're complaining about... having to hear it.
tjwebbnorfolk | a day ago
anonymous908213 | a day ago
tjwebbnorfolk | a day ago
Politics is a game. It is played with one single objective: to make sure that the people with no political power remain fighting among themselves instead of fighting those with power. If you believe some favored political faction will solve these problems you mention, then it is you who is missing the entire point.
anonymous908213 | a day ago
> How the produce of society is distributed and how people are cared for has zero relevance to an article about hacking a text editor,
The article is political. People make noise about Taiwan because an invasion of Taiwan would kill many and oppress more, in other words because it, like all political matters, is something that determines the course of lives of millions. Even if they are not directly affected, noise about politics escalates as a mechanism for people to protect themselves. When you are at the wrong end of a group that outnumbers you trying to kill you, you will require the aid of others. But will others come to your aid if you were not willing to come to their aid? This is how the concept of a "conscience" and "empathy" evolved -- because they give an evolutionary advantage, of providing for your own survival by ensuring collective survival.
Edit: for posterity, the comment I was replying to mentioned a "belief in either team leading you to the promised land", which has been edited out.
tjwebbnorfolk | a day ago
You seem very angry at a stranger on the internet. I think a break from thinking about everything through the lens of politics might be good for you.
anonymous908213 | 23 hours ago
Access to water is political. If you get water from the city, the building of infrastructure delivering water to your residence is political. Whether or not that water is polluted is political. If you get your water from a well on your own property, your ownership of that land is political. None of that is achieved without group consensus, and group consensus can take all of it away from you. You are able to ignore that fact because all of those political consensuses are currently going in your favor, but the same is not true for everyone, and when it isn't true for them, they can be predicted to make noise about not having access to water for obvious reasons. They will make noise about it everywhere they can because it will be more important than anything else to them, given that it will determine whether they live or die and they need to galvanize communal support in order to reverse their fortunes.
> You seem very angry at a stranger on the internet. I think a break from thinking about everything through the lens of politics might be good for you.
My previous comment was written entirely neutrally, so I'm not sure how you came to that conclusion. Incidentally, I happen to live in a prosperous and stable society that I have confidence will remain secure for decades to come, so I have the privilege to ignore politics at my leisure. I am grateful for that opportunity, but I also understand how much of a privilege it is that politics are going well and not actively creating problems for me, so when other people complain about political processes creating problems for them, like the threatened invasion of their country, I listen without complaining.
I took HN as a place for rational discussion, so I made an effort to communicate to you why politics are so important to many, but in the end it seems this discussion is fruitless. If there is any emotion I feel, it is that of disappointment for wasting my time trying to discuss things logically and rather than being met with any kind of reasoned rebuttal, I get a childish dismissal the likes of which I could've gotten on Reddit, which I stopped using for that very reason a decade ago.
miningape | 22 hours ago
Ah but didn't you know, some activist professor with a stick up his ass once said "everything is water" - so even not wanting to talk about water is in fact your water privilege of not talking about water. /s
Orygin | 18 hours ago
Articles about families living close by, which water bills exploded recently?
On the other hand, you don't see commenters saying that they are indifferent to their access to water, and that they are tired seeing others being engaged in the conversation.
If it's not impacting you, I don't blame you not participating. But I feel (general) you don't get to push down on others because they are discussing important topics (to them).
pibaker | 7 hours ago
The same with politics. When politicians keep their hands off the society, no one feels pressed to talk about politics. When an authoritarian regime compromises a widely used open source software to conduct espionage, of course people will start talking about politics.
mshroyer | a day ago
No, it explicitly is not, and this "deepity" doesn't change any rational analysis. The injection of politics into every aspect of society must and should be refused.
direwolf20 | 18 hours ago
hnuser123456 | 15 hours ago
akimbostrawman | 8 hours ago
appreciatorBus | a day ago
I read about politics all day long in many different places. My belief that HN should be relatively free of such stories is not because I believe I can detach myself from politics, but because I believe topic based forums are more valuable and useful than “anything goes” forums.
stackbutterflow | 19 hours ago
direwolf20 | 18 hours ago
appreciatorBus | 15 hours ago
Not only does politics and general stories crowd out everything else over time on other sites, there are HN submitters who seem to be trying to accelerate this.
During the war, when HN was getting Israel-Palestine stories constantly, I started looking at the submission history of some of the submitters, and some of them were just pushing these types of stories every day for months and months.
So yes, I think allowing politics will eventually mean being dominated by politics and general interest.
alighter | 14 hours ago
If HN is going to allow accusations to be slung against groups of people it has to allow others to respond, and that sets off endless debate amongst people who will not be changing their minds on the matter but will repeat the same argument on the next post.
teo_zero | 23 hours ago
If this is true, I'd like to know what a weak political view is instead!
direwolf20 | 18 hours ago
illiac786 | 22 hours ago
GaryBluto | 19 hours ago
expedition32 | 18 hours ago
They are making a mistake I was never political!
illusive4080 | 18 hours ago
HN discussions are usually very high quality and respectful disagreement therein, which is unique online nowadays.
I’ve come here to escape Reddit, which is all politics all the time. If this place turns as political as Reddit, I’m out.
vkou | a day ago
orbisvicis | a day ago
http://iccf-holland.org/ http://www.vim.org/iccf/ http://www.iccf.nl/
You can also sponsor the development of Vim. Vim sponsors can vote for features. See |sponsor|. The money goes to Uganda anyway.
DaSHacka | 22 hours ago
joshuaissac | 22 hours ago
https://neovim.io/sponsors/
NekkoDroid | 18 hours ago
When you launch a plain nvim instance you get the following:
> Help poor children in Uganda!
> type :help Kuwasha<Enter> for information
idiotsecant | a day ago
t-3 | a day ago
nophunphil | a day ago
I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it.
Another angle: would such free protest be allowed if the developers of Notepad++ were based in China or Russia? I seriously doubt it.
handedness | a day ago
He who politicizes everything politicizes nothing.
kvemkon | a day ago
- US arguing for independence of any of the States for whatever reasons?
- Spain for Catalonia?
- France for Basque?
and many more just in Europe.
https://en.wikipedia.org/wiki/List_of_active_separatist_move...
nophunphil | a day ago
> Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.
If you’re calling Ukraine in particular a “separatist movement”, I don’t think we can have a productive conversation.
kvemkon | 16 hours ago
- Ukraine for Donbas
Which is so much weaker than all others. There are Ukrainians, Russians, Chinese, Tibetans. But there is no such ethnicity as People of Donbas.
OTOH in a democratic state you're still have the right to demonstrate peacefully for whatever you want, even if it doesn't make much sense. But would you allowed to demonstrate in Ukraine for Donbas independence if they are considered separatists according to the law?
FormerBandmate | a day ago
You can’t be against the Ukraine war in Russia because Putin is an evil dictator
leosarev | a day ago
sunaookami | 21 hours ago
wiseowise | 20 hours ago
sunaookami | 11 hours ago
nophunphil | 8 hours ago
kvemkon | 16 hours ago
"Say" in the sense of demonstrate peacefully for this? Then I'm impressed. If someone else can confirm this? Is this because of USA being a federal union? Before Ukraine declared independence, there were voices to make Ukraine a federal state, so that people in the West part of Ukraine can live their way of life and people living 1600 km (!) away in the East and Southern parts would be not much affected from that and vice versa. Voices for the unitary state were stronger because of stability of the state. Would be interesting to see some documentary "what if", whether a federal state would be more stable against pulling from the west (Europe, US) and the east (Russia).
lII1lIlI11ll | 13 hours ago
You are falling for Russian propaganda about evil western-Ukrainian nazis attempting to enslave peaceful-Russian-speaking-peoples-of-Donbass-or-whatever who were just minding their own business ("way of life"). As a Russian-speaking Ukrainian neither do I want Putin to protect me (apparently by looting my apartment and raping my girlfriend or in whichever way he is trying to do it these days), nor do absolute majority of population of, say, Kharkiv, Odesa or Kherson.
> Voices for the unitary state were stronger because of stability of the state. Would be interesting to see some documentary "what if", whether a federal state would be more stable against pulling from the west (Europe, US) and the east (Russia).
As a Ukrainian I find that idea quite laughable. It is not really possible for a part of federal union (say a state of USA or a Swiss canton) to join NATO and for other part to "decide" to become a Russian-occupied quasi-state like Belarus. Same goes for a part of it joining EU while some other part decides it wants to be part of EAEU Customs Union. State's foreign affairs are still decided by some central government.
Also, you can research how great "deciding on their own way of life" works in Russian Federation. You could start with first and second Chechen Wars.
kvemkon | 15 hours ago
I was glad after discovering [1]. In one of the videos the interviewer explains, why he was not arrested. The channel is for English-speaking auditory outside of Russia. It was enough to "close eyes" for some openly expressed critiques. Though it was painfully to listen to some people who were not against the war.
[1] https://www.youtube.com/@1420channel/videos
p_ing | a day ago
I think about a lot of things I do absolutely nothing about (or with).
Thinking about whatever messaging is here is like saying "thoughts and prayers". It means shit all nothing. The messaging was a waste of my time and your time. It was an ad for a product you'll never purchase.
nophunphil | a day ago
p_ing | 14 hours ago
iamnothere | a day ago
I don’t think I am the only one who has this reaction. People who do this should consider if it’s actually helping their cause. If not it’s just feelgood signaling, or possibly even counterproductive.
Orygin | 18 hours ago
Do you see how insane that seems? (Replace fascism with whatever topic is relevant to you).
It has the same energy as "Yeah they started killing civilians, but it was that or pronouns, y'know".
iamnothere | 16 hours ago
Orygin | 15 hours ago
As an example, do I find some vegans annoying on the internet? Yes. Does it mean I will instead start supporting carnism, or push back on veganism? No, absolutely not. Because these are values I have, and no actions of others can change what I value.
iamnothere | 12 hours ago
throw5543e4f | 14 hours ago
joejoe638 | a day ago
nophunphil | a day ago
So what about protesting the Russian invasion of Ukraine seems objectionable to you?
> it is fair to say that Notepad++’s freedom to protest would depend on who and what they are protesting.
What? In the US, UK, and Australia, the right to protest (i.e. of speech) does not depend on what’s being protested in the way you’re implying.
abdelhousni | 23 hours ago
popalchemist | a day ago
com2kid | a day ago
Freedom of speech is political.
The right to privacy is political.
Letting people on to the Internet without censorship is political.
Government policies that support startups are political.
Threatening to arrest teens for pirating mp3s is political.
> I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.
For the people actually impacted by politics, reality rarely waits for a convenient time to interrupt.
Political reality tends to knock down doors and blow up buildings when it wants to really get someone's attention. "Don't bother me during my software updates" is a privileged position to be able to take.
wodenokoto | a day ago
Being political isn’t a hobby you attend on Tuesdays, it’s real decision that affect people’s lives every single day, sometimes with deadly consequences.
melagonster | a day ago
mmsc | a day ago
leosarev | a day ago
You know that's official position of 99% countries in the world, including all superpowers and every NATO member?
mmsc | a day ago
99% countries, as they say, "acknowledge China's viewpoint".
maxglute | a day ago
mmsc | 23 hours ago
maxglute | 23 hours ago
>A majority of countries (119 or 62 per cent of UN member states) have endorsed Beijing’s one-China principle, which entails that Taiwan is an inalienable part of the People’s Republic of China.
I was being generous bucketing 20 mixed signallers with 40 status quoist. 120 agree TW inalienable part of China, as in TW can never be independent from one China construct (PRC's position). 20 agree it's part of China but not necessarily inalienable, i.e. TW/ROC should have pathway to independence but until they formalize, still part of China. AKA 75% is in recognize tier.
direwolf20 | 18 hours ago
Everyone, including 99% of the world's politicians that don't have their heads up their asses, including the ones who wrote the official positions that Taiwan is not a country, knows Taiwan is a country.
simion314 | a day ago
As one should, I avoid stuff that have a very loud fascist author/owner. So we should be happy for this people to show what they believe in, this way we can decide not to help fascists(and others can decide to support them and not to help one of the other sides)
kstrauser | a day ago
Free Software is inherently political. It’s like ordering a cheeseburger and being shocked that it has meat in it.
mmooss | a day ago
direwolf20 | 18 hours ago
jdiff | 18 hours ago
> People will tell me again to not mix politics with software/business. Doing so surely impacts the popularity of Notepad++: talking about politics is exactly what software and commercial companies generally try to avoid. The problem is, if we don’t deal with politics, politics will deal with us. We can choose to not act when people are being oppressed, but when it’s our turn to be oppressed, it will be too late and there will be no one for us. You don’t need to be Uyghur or a Muslim to act, you need only to be a human and have empathy for our fellow humans.
trymas | 16 hours ago
I find this take deeply ironic.
And here due to alleged political take of some software (Notepad++), __state sponsored software__ was used to attack users of said software. Something actually happened!
You don't want to see politics in any software, but may be (or already are) a victim of political software attack (from state sponsored tracking, to sanctions, to political psy-ops through software distributing (social) media).
> <...> Maybe I tell my adblocker to remove the messaging, and carry on with my task. > > I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.
You are clearly annoyed by ads, like many of us - maybe you should get public attention to change policy about ads? How they are annoying? How there are unskippable Ads in TV services that I pay money for? How there are big enterprises using their monopoly/oligopoly powers to make you stop being able to adblock ever again? Or do you only block ads you deem "political"?
_______
States (and not only them) will use software and even open source software (open source IMHO is also a political take/view) to get to you if it's ever needed. Though congrats you just got extra social credits in __both__: China's and Palantir's databases!
throw5543e4f | 14 hours ago
tjpnz | a day ago
MengerSponge | a day ago
airstrike | a day ago
direwolf20 | 18 hours ago
avazhi | 22 hours ago
ValveFan6969 | 18 hours ago
pandemic_region | 14 hours ago
orsorna | a day ago
I distinctly remember their GH page being flooded with issues written in Chinese.
maxkfranz | a day ago
My opinion is that open source documentation is like polite dinner conversation: It’s not the proper place to discuss politics.
If an author wishes to use their open source project as a platform to discuss politics, that’s the author’s prerogative. But then, as perhaps in this instance, it could be to the detriment of the project itself.
davorak | a day ago
I know this is a common turn of phrase, but I can not help thinking that if the political conversation is impolite it is because some in the conversation is being impolite not due to the topic itself.
cespare | a day ago
I'm going to place the blame on the party committing the crimes, not the person exercising free expression.
jajuuka | a day ago
mckn1ght | a day ago
See something in the release notes of an app you don’t like? Go use a different app, give your money to a different entity. Don’t spend your time and resources messing with the producer or user of the thing you don’t like.
This of course runs the risk of maximal polarization once everyone has filtered themselves into their neat and tidy little bubbles. What happens then, everybody leaves each other alone? Or do the echo chambers slide into further radicalized detachment from each other?
jajuuka | a day ago
To get back on topic though, I think conflating using Y app with holding X position on a topic like politics is a dangerous road. Which is where I think having a dedicated space for those politics makes more sense. Whether that's a blog, twitter, etc. It allows those most dedicated to you to know you better without making the product or program a political stance. But the developer is ultimately free to do what they want. So it's not like anyone here can tell the developer to change in any way.
Wilder7977 | 22 hours ago
So the free expression is considered by everyone according to their own ethical and moral values.
jajuuka | 16 hours ago
surajrmal | a day ago
ozim | a day ago
maxkfranz | a day ago
jojobas | 22 hours ago
neoromantique | 19 hours ago
You can ignore politics, but at certain point, politics cease to ignore you.
shevy-java | 23 hours ago
It is also annoying that all these three countries think they can bully other countries too. That is basically them saying they can kill other people in other countries at all times no matter the real "reason" (just make up a fake reason, such as Russia with regard to Ukraine) - annoying to no ends.
Having said that, and I just pointed out I disagree with mainland China bullying the Taiwanese, I think it would actually be better to have software itself be completely apolitical. I never understood why people felt a need to tie political goals into software. That is a valid statement even if I happen to agree with the political goals here.
Wilder7977 | 22 hours ago
If anything, we need much more politics in software, ideally exercised by those who write that software instead of "apolitical" software writers who end up executing the political software of those who pay them.
If you meant to scope your statement only to FOSS, then this still applies (in fact, FOSS is inherently political), plus I suppose some people who invest their time to write software want to also use the same effort for political activism and there is nothing wrong with that. This can be expressing their political views via that software (e.g., vim and the support to children in Uganda) or can be using a license that only allows co-ops to run their software, or many other ways.
The idea that software even could be apolitical stems from the idea that technology can be neutral, which again, in 2026 is really a tough idea to support.
lelanthran | 19 hours ago
Where's the bar where you shut down discussion? I mean, even politics is contextual, right?
You entering a campaign about the plight of Myanmar and getting annoyed at people who don't want to hear your message about Gaza puts the blame for any conflict arising on that purely on ... YOU!
IOW, Even within political discussion, you can still be off-topic!
> If you meant to scope your statement only to FOSS, then this still applies (in fact, FOSS is inherently political)
Entering a GNU project (which has the political context of Copyleft and IP reform), and attempting to use it to spread a message about ICE behaviour still makes that asshole behaviour.
Only the most extremist true-believers feel that every platform is for their benefit. Trust me, it's not.
Wilder7977 | 19 hours ago
Being political for software means for example making some specific choices while designing it and advertising them as such. Means choosing a license over another. Means announcing political positions and possibly aligning the software to them (depending on what it is).
It doesn't mean going in forums related to that software to discuss random political topics.
lelanthran | 15 hours ago
Okay, lets assume you are correct[1]; is that a counterargument to my main argument:
>> IOW, Even within political discussion, you can still be off-topic!
------------------------------------
[1] I don't think I am confused about the difference, TBH - I explicitly called out political preference of a project and political discussion within the project.
jojobas | 22 hours ago
jmole | a day ago
e.g. iTerm, Cyberduck, editors of all shades, various VSCode extensions, etc.
josho | a day ago
hsbauauvhabzb | a day ago
Arainach | a day ago
calvinmorrison | a day ago
SoftTalker | a day ago
hsbauauvhabzb | a day ago
technion | a day ago
guessmyname | a day ago
It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS ecosystem.
And this is not unique to macOS, this is all possible in Windows, Linux and any other OS.
[1] https://www.obdev.at/products/littlesnitch/index.html
jonas21 | a day ago
3eb7988a1663 | a day ago
The state of the world is such that I have started running everything inside VMs. Baseline OS install + virtual machine management and that is it. Which is still not immune, but makes me feel a lot better than core OS utilities are probably getting better vetting than nifty-utility-123 on which I depend.
velocity3230 | 23 hours ago
drum55 | a day ago
worthless-trash | a day ago
Source. I work for a company for longer than the internet has been alive.
drum55 | a day ago
worthless-trash | a day ago
dfc | a day ago
worthless-trash | 23 hours ago
Like saying pstn and fiber are different things.
nickorlow | a day ago
g-b-r | 23 hours ago
sciencejerk | 11 hours ago
scratchyone | a day ago
guessmyname | a day ago
We also need better computer science education in high schools, teaching students how to inspect network packets, verify SSL certificates, and evaluate whether a binary blob might contain malicious code.
People have gotten complacent about the internet, which is why they still get hacked, when it should be the other way around. With everything we’ve learned over the years, why are breaches more common than ever? I don’t understand why people are so careless about online security today, compared to decades ago when we were taught not to share personal information and not to trust anything on the internet.
drum55 | a day ago
kemotep | a day ago
velcrovan | a day ago
eviks | a day ago
sciencejerk | 11 hours ago
93po | a day ago
g947o | a day ago
g-b-r | 23 hours ago
sjnonweb | 23 hours ago
notpushkin | 21 hours ago
efreak | 21 hours ago
Having said that, I absolutely despised the implementation that stole keyboard focus; if it popped up when I was typing it frequently disappeared before I head a chance to read it and I had to go into settings to try and find what had changed. Nothing should ever steal keyboard focus unless it's urgent, and then it should website that you can't accidentally manipulate it with a keyboard (see UAC prompt where it opens in the background if the calling program is in the background, and where once you activate it, you have to hold alt+y/n or tab to a button before it accepts the input; just hitting the y/n key alone won't do anything).
johnsillings | a day ago
opan | a day ago
Dylan16807 | a day ago
OsrsNeedsf2P | a day ago
This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected
gruez | a day ago
No, it should be a hardcoded key held by the developer, preferably using a HSM, and maybe with some sort of notification capability in case the key was lost. Adding a second server adds marginal security. For instance if the developer's mail was hacked, an attacker would likely be able to reset passwords for both hosting providers.
dontdoxxme | a day ago
technion | a day ago
notepad-plus-plus.org currently has an A record of 95.128.42.184, owned by "Aqua Ray SAS".
It switched up from 191.101.104.10 and 212.1.212.49 on 17/1, which is are Hostinger IP addresses.
kwar13 | a day ago
Larrikin | a day ago
I expect to know it one day, but it may be too early to provide the name now.
nickorlow | a day ago
r1ch | a day ago
I'm pretty surprised that they got away with unsigned updates and shared hosting as long as they did. I wonder how many similar popular projects are out there on dodgy infrastructure.
nosrepa | a day ago
egl2020 | a day ago
Marsymars | a day ago
nickorlow | a day ago
snvzz | a day ago
jimbob45 | a day ago
bakugo | a day ago
egl2020 | a day ago
davorak | a day ago
There are more steps you can take to ensure greater safety. The above is the minimum a I do for myself and what the minimum IT department and my company executes.
opan | a day ago
prodigycorp | a day ago
I subscribe to MacPaw, who makes excellent apps like Setapp, Gemini, and CleanMyMac, all of which I use.
At some point, CleanMyMac started putting the Ukranian flag on the app icon and flagging utilities by any Russian developer as untrustworthy (because they are russian), and recommended that I uninstall them.
I am not pro russia/anti-ukraine independence by any means, but CleanMyMac is one of those apps that require elevated system permissions. Seeing them engage in software maccarythism makes me very, very hesitant to provide them.
_alternator_ | a day ago
stackghost | a day ago
permo-w | a day ago
stackghost | a day ago
I suppose, though that's not really how I tend to see it phrased on socials or in the media.
litbear2022 | a day ago
sb057 | a day ago
That is a very controversial statement, and one that both Taipei and Beijing disagree with.
Supermancho | a day ago
fc417fc802 | 5 hours ago
smuhakg | a day ago
The Taiwanese government has never formally declared itself independent from the mainland. Such a declaration would likely cause the PRC to invade.
https://en.wikipedia.org/wiki/1992_Consensus
sMarsIntruder | a day ago
prodigycorp | a day ago
Please refer to it for context.
gradus_ad | a day ago
Barrin92 | a day ago
Fuck'em and just donate ten bucks to notepad++ , I'd rather my pc breaks then reward this crap
prodigycorp | a day ago
suprstarrd | a day ago
Barrin92 | a day ago
American and European infrastructure is subject to cyber attacks that that are effectively hostile military acts already. I don't think a vocal stance on Ukraine and an exclusion of Russian developers deserves the rhetoric of McCarthyism or being 'too political' as is these days a fashionable accusation. This is no red scare, this is speaking up for people bombed on a daily basis.
generalizations | a day ago
I'm sure it felt very real at the time.
stavros | a day ago
throwaway3060 | a day ago
Since there are a lot of both Ukrainian and Russian software developers, this is personal for a lot of people in the industry.
wiseowise | a day ago
What the fuck is that supposed to mean, lol. Ukraine isn’t done secessionist state.
> Seeing them engage in software maccarythism makes me very, very hesitant to provide them.
So are they wrong when flagging software or not? You haven’t provided any details.
getcrunk | a day ago
getcrunk | a day ago
I mean for such a dev focused and extremely performant app, that’s disappointing.
Glad I’m off windows as of late
gruez | a day ago
tech234a | a day ago
bakugo | a day ago
Something doesn't seem right here.
adzm | a day ago
firesteelrain | a day ago
Something of Notepad++ size might think about it now
abeyer | a day ago
eviks | a day ago
firesteelrain | 22 hours ago
Mr. Ho already has hosting charges and he uses GitHub. For those who use GitHub, he could continue his GnuPG method for signing. Additionally, GitHub integrates with Sigstore. Windows wouldn’t trust his signature but at least there would be better traceability. Version 8.8.7 labeled “authenticity guaranteed” is a step in that direction.
The real “issue” here was his outside hosting platform for updates from my reading of the article.
hjoutfbkfd | 22 hours ago
firesteelrain | 22 hours ago
https://support.certum.eu/en/code-signing-required-documents...
https://shop.certum.eu/open-source-code-signing-on-simplysig...
$49 (EU) Gross
1una | 22 hours ago
sbohacek | 13 hours ago
bakugo | a day ago
They go on about how their server was compromised, and how the big bad Chinese were definitely behind it, and then claim the "situation has been fully resolved", but there is zero mention of any investigation into what was actually done by the attackers. Why? If I downloaded an installer during the time they were hacked, do I have malware now?
The utter lack of any such information feels bizarre.
mimasama | a day ago
mikeweiss | a day ago
starkeeper | a day ago
davorak | a day ago
> 2. Even though the bad actors have lost access to the server from the 2nd of September, 2025, they maintained the credentials of our internal services existing on that server until the 2nd of December, which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php to their own servers and return the updates download URL with compromised updates.
daemonhunter | a day ago
avereveard | a day ago
hug | a day ago
FTA.
freitasm | a day ago
"The security exper’s analysis indicates the attack ceased on November 10, 2025, while the hosting provider’s statement shows potential attacker access until December 2, 2025. Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated."
avazhi | 18 hours ago
Thanks for your nonanswer, though. It was about as unhelpful and unspecific as the original blogpost for this.
kijin | a day ago
As for whether anything else has been compromised, it depends on whether you were targeted. And the payload might have been tailored to each target, so there's no way to know unless you have access to the exact binary. Unfortunately, binaries downloaded through the auto update feature tend not to linger in your Downloads folder.
username223 | a day ago
bibimsz | a day ago
username223 | a day ago
pxc | 15 hours ago
And for more modern software distribution mechanisms (e.g., Nix, Guix, Flatpak), centralized package updates may not actually run any vendor code with high privileges at all.
The norm for proprietary software updates on Windows is indeed a free-for-all of every publisher downloading and running code with admin rights, and it is indeed a terrible way to operate. Avoiding that kind of madness doesn't necessarily mean running lots of old, vulnerable software.
tragiclos | a day ago
I'd be curious to know if there was any pattern as to which users were targeted, but the post doesn't go into any further detail except to say it was likely a Chinese state-sponsored group.
x_may | a day ago
pavon | a day ago
buggymaaan | a day ago
IhateAI | 11 hours ago
manapause | a day ago
thomasjudge | a day ago
burnt-resistor | a day ago
After a machine is compromised by malware, there's rarely-to-never a trustworthy way to ever fix it with 100% certainty. And especially worrisome is "repair" from the host itself which maybe infected with a rootkit that hides and repairs the malware. Thus, the only correct solution is to completely reimage/reinstall from trusted sources. Deviate from this path at one's own extreme cost/risk.
There also exist a tiny amount of even worse, specialized malware, usually deployed by state actors, that infect hardware in such a way that makes them difficult and sometimes uneconomical to repair.
PSA: Never run untrustworthy shit on any machine that matters. This also includes FOSS projects that don't have their shit together.
eviks | a day ago
burnt-resistor | 21 hours ago
conception | a day ago
nickorlow | a day ago
dehrmann | a day ago
ivankabiden | a day ago
wglass | a day ago
Is it correct to say that users would only get the compromised version if they downloaded from the website?
Notepad++ has auto-update feature, is there any indication that updates from the AutoUpdate were compromised?
jszymborski | a day ago
> The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
Lammy | a day ago
Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location based on the set of software you have installed, all of which want to check for updates every goddamn day.
arcfour | a day ago
Threat modeling: it keeps things realistic.
Lammy | a day ago
I once worked at a company where the Security team were very proud of this and all the other tricks they used to catch leakers by figuring out who was on campus, where, at what time, usually via fingerprinting personal devices carried alongside corporate devices.
arcfour | a day ago
And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, and even that's going away...?
Lammy | a day ago
You are confusing cause with effect. Leaking this type of fingerprint data over time is what allows users of Palantir-like systems to decide you're somebody worth individually targeting.
derf_ | a day ago
mmis1000 | a day ago
And there isn't really a way to confirm if it is configured in a secure way.
You either trust the developer or not.
einr | a day ago
g-b-r | 23 hours ago
And, in many cases you can get some protection from a developer going rogue (or not writing perfect code), it's not an all or nothing.
sodality2 | a day ago
Lammy | a day ago
hypeatei | 18 hours ago
Lammy | 10 hours ago
That would be two things that would have to be compromised and redirected simultaneously to malicious versions. Way more likely to be noticed too because one of them would be GitHub, and unless they mirror the entire rest of the package metadata index and keep it up to date for everything else besides their targeted malicious package.
edb_123 | a day ago
Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start? Though I would assume these malicious updates would be clever enough to rather have dropped and executed additional files, rather than doing something with the Notepad++ binaries themselves.
And I agree with another comment here. With all those spelling mistakes that notification kind of reads like it could have been written by a state-sponsored actor. Not to be (too) paranoid here, but can we be sure that this is the actual author, and that the new version isn't the malicious one?
hinkley | a day ago
I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at the problem statement.
I still think I'd like to have a web of trust system where I let my friends try out software updates first before I do, and my relatives let me try them out before they do.
ozim | a day ago
Melatonic | 23 hours ago
Nition | a day ago
nxpnsv | a day ago
Nition | a day ago
whywhywhywhy | 20 hours ago
greazy | 20 hours ago
wiether | 20 hours ago
amount? ;)
Gander5739 | 20 hours ago
skeledrew | 16 hours ago
And who do they let try the software before they do? And so on... Where does it ended?
timbit42 | 12 hours ago
dec0dedab0de | 14 hours ago
QuiEgo | 13 hours ago
Loved that class.
user3939382 | a day ago
FpUser | a day ago
topspin | a day ago
Now I need to worry about this one. I've been anxious about vscode lately: apparently vscode extensions are a dumpster fire of compromises.
FatalLogic | a day ago
Notepad++ site says The incident began from June 2025.
On their downloads page, 8.8.2 was the first update in June 2025 (the previous update 8.8.1 was released 2025-05-05)
So, if your installed version is 8.8.1 or lower, then you should be safe. Assuming that they're right about when the incident began.
edit: Notepad++ has published, on Github, SHA256 hashes of all the binaries for all download versions, which should let users check if they were targeted, if they still have the downloaded file. 8.8.1 is here, for example - https://github.com/notepad-plus-plus/notepad-plus-plus/relea...
z3t4 | 22 hours ago
JoystickX02 | 18 hours ago
otherme123 | 23 hours ago
Did I understand the attack wrongly? The software could have a 100% correct checksum, because the attack happened in a remote machine that deals with call home events from Notepad++, I guess one of those "Telemetry" add-ons. The attackers did a MITM to Notepad++ traffic.
tempestn | 23 hours ago
7bit | 18 hours ago
However, there are ways around this, too. No solution is perfect.
tasuki | 22 hours ago
Is this surprising? My model is that keeping with the new versions is generally more dangerous than sticking with an old version, unless that old version has specific known and exploitable vulnerabilities.
illiac786 | 22 hours ago
card_zero | 22 hours ago
One comment there points out that XP is old enough for infected attack vectors to have all died out. I dunno.
illiac786 | 22 hours ago
But good we are talking about my point rather than than the example.
badsectoracula | 21 hours ago
The video referenced in that article explicitly connects directly to the internet, using a VPN to bypass any ISP and router protections and most importantly disables any protections WinXP itself has.
So yeah, if you really go out of your way to disable all security protections, you may have a problem.
conorcleary | 19 hours ago
illiac786 | 12 hours ago
My point is, statistically, it is more secure to install updates as fast as possible.
We can take another example: search for “shitrix”, there’s thousands more CVEs out there to use as example.
bigfatkitten | 21 hours ago
expedition32 | 18 hours ago
"Fixed some bugs" Yes thank you very helpful that! Now I can make a very informed decision.
latexr | 9 hours ago
tasuki | 16 hours ago
pxc | 15 hours ago
bulbar | 12 hours ago
The threat model for a server and for a personal computer are very different. On a consumer device, typically only the OS mail app and browser have direct contact with the outside world.
pibaker | 8 hours ago
On the other hand, any server running old, unpatched versions of apache or similar will get picked up by script kiddies scanning for publicly known vulns very, very fast.
The notepad++ attack is politically targeted and done through unconventional channels (compromise in the hosting provider). I don't think 99% of the people reading this thread has a comparable threat model.
slumberlust | 17 hours ago
Love notepad++ and will continue to use it.
1vuio0pswjnm7 | 14 hours ago
This is true for a large number of software "security" issues
A software version earlier in date/time is not necessarily inferior (or superior) to a version later in date/time
As it is "updated" or rewritten,, software can become worse instead of better, or vice versa, for a vaariety of reasons
Checking software's release date, or enabling/allowing "automatic updates" is not a substitute for reading source code and evaluating software on the merits
beached_whale | 14 hours ago
bulbar | 13 hours ago
Updates are a direct connection from the Internet to your computer. You want to minimize that.
Just do a manual update from time to time.
dabinat | a day ago
I get that this is a difficult situation for a small developer, but ending with this line did not fill me with confidence that the problem is actually resolved and make me trust their software on my system.
the_fall | a day ago
The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be.
xeromal | a day ago
tjwebbnorfolk | a day ago
trympet | a day ago
m-schuetz | a day ago
g-b-r | 23 hours ago
m-schuetz | 21 hours ago
g-b-r | 20 hours ago
However much the code is hidden and obfuscated, some parts of the source code are going to be looked upon.
For a binary, none, ever, except in the extremely rare case that someone disassembles and analyzes one version of it.
The fact that open-source doesn't coincide with security doesn't mean that it isn't beneficial to security.
hjoutfbkfd | 22 hours ago
avazhi | 22 hours ago
I mean, if you look at the Notepad++ website this developer seems just as concerned at spamming political messaging all over everything as much as he is with writing the software he's distributing. It's pretty crazy he apparently didn't think to take more basic precautions given he is basically permatrolling Russia and China with his messaging. Big brain moment for him. And meanwhile, after reading that disclosure nonsense none of us even know what's going on - like, should we be formatting machines that were affecting during that timeframe? Was the attack targeted and specific only? Who the fuck knows!
the_fall | 15 hours ago
avazhi | 10 hours ago
I definitely am not upset at the commenter I replied to, and while I'm definitely upset at the maker of Notepad++ I don't think he qualifies as some random person on the internet. If you publish software that security conscious people use (and certainly Notepad++ is used by tech savvy security-conscious people) then you, really by definition, aren't some random person - that's kinda the whole point. Security conscious and tech savvy people tend not to install things from random people on the internet.
Notepad++ was a trusted website/trusted developer, and they got caught with their pants down doing some truly dumb and lazy shit, and then they published a blogpost that doesn't explain much of anything. So yeah, that's pretty infuriating my friend.
baobabKoodaa | 23 hours ago
shellcromancer | a day ago
The latest and greatest cryptography powering everyone’s favorite SAML-based single-sign on.
Helmut10001 | a day ago
[1]: https://chocolatey.org/
locusofself | a day ago
hjoutfbkfd | 22 hours ago
who signed the binaries was irrelevant for this attack, because the issue was not checking any signature
zeroq | a day ago
It seems to be a lot like the communism - sounds great on paper but we are yet to see a proper implementation.
Between GIT, Linux and SQLite there are a few projects that has been led by weirdos that have time, resources and conviction to drive these through time.
Unless you create some sort of a an auxiliary business and get an acquihire deal most things will fizzle out.
Years ago when I started working for BigCo I was amazed by their denial of FOSS. At one point in the project I pointed out a problem, which was heard and recognized, to which I followed up with a solution using an open source package. I thought I was clever - we needed an extra package in our system, but I was able to find a suitable open source solution that would not add to the overall cost of the project. My proposal was immediately pushed back.
Initially I thought it was due to responsibility issue - if we'd employ a FOSS solution we'd be responsible for the outcome. Having a 3rd party vendor the management would have the opportunity to shell themselves.
But that doesn't have to be the case. The FOSS project could easily fizzle out. And if we don't have enough resources to incorporate it and make it our own, we can potentially risk being left out to dry.
autoexec | a day ago
This is acceptable. Why shouldn't most things started by people not willing to put in the work to keep them going not fizzle out? The important thing is that anyone who actually cares to can jump in and pick up right where the open source software fizzled out and get it going again. Anyone can learn from the code and use it for anything they want, even things that have nothing to do with the goals of the original project.
It's not as if there aren't countless examples of corporate vendors dying off and leaving their customers on the hook with nothing, or just changing the product drastically after the sale. At least in the open source case you have the option to fork the project and continue using it as you always have.
colonCapitalDee | a day ago
dyauspitr | a day ago
sharyphil | a day ago
paul_h | 23 hours ago
All such portals upgrade their hash/sig noting of binaries, and keep those in a history retaining merkle tree of sorts. Of nothing, else a git repo. Something like this https://github.com/hboutemy/mcmm-yaml/blob/master/aws/sdk/ko... but with SHA256s, and maybe not the entire world on one repo.
shevy-java | 23 hours ago
Notepad++ is a great editor. I don't use it on Linux, because I have an older editor I am very used to, but on Windows I like notepad++ a lot (though lately I have been using geany on Windows, mostly for convenience - I think notepad++ is better but I sort of like the github-based development of geany; either way notepad++ is really excellent as well).
Ayesh | 23 hours ago
Winget downloads the installer from GitHub: https://github.com/microsoft/winget-pkgs/blob/master/manifes...
maremmano | 22 hours ago
This time I unfortunately have to move on from Notepad++. Vibes have been negative for a while but out of inertia (and because there weren't obvious alternatives) I never pulled the trigger. Now it's time. The trust is gone.
Thanks NP++ for being free and useful for so many years.
Can anyone suggest a solid alternative on Windows? I'm fine with Linux and macOS but I have to keep a Windows machine around for some legacy, win only, software.
Maybe Sublime Text could be an option? At this point I'd rather pay for something lightweight, fast, and probably better.
I don't like tooling that increases my exposure to bad state actors (whatever state they're from).
nzd | 22 hours ago
maremmano | 22 hours ago
hansifer | 6 hours ago
nhinck3 | 22 hours ago
> Can anyone suggest a solid alternative on Windows
What a weird reason to switch. I don't know why you'd believe any other piece of software is somehow more secure against state actors.
rdiddly | 13 hours ago
bravetraveler | 22 hours ago
_cs2017_ | 22 hours ago
benterix | 22 hours ago
Jnr | 22 hours ago
I think Linux has the best solution for this - good package managers for bases system and Flatpak with Flathub repo for other apps. So you never get stupid popups, and update managers use signed packages and check those signatures before installation.
throwa356262 | 21 hours ago
Which versions where affected and how can people check if they have the infected version?
antiloper | 21 hours ago
XMLDSig is notoriously difficult to implement correctly and securely, I hope this doesn't backfire.
Aqua0 | 20 hours ago
charlieyu1 | 19 hours ago
charlieyu1 | 19 hours ago
Saris | 13 hours ago
Absolutely no reason a text editor needs internet access.
I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.
Pet_Ant | 12 hours ago
Bender | 12 hours ago
MisterTea | 11 hours ago
Saris | 10 hours ago
just_testing | 11 hours ago
Saris | 10 hours ago
It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.
valbu | 6 hours ago
Saris | 6 hours ago
Wildcards are great, like you said for those apps that change the directory name every single update.
sciencejerk | 11 hours ago
np1810 | 10 hours ago
For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done.
[0] https://github.com/objective-see/LuLu
nonamenoslogan | 10 hours ago
djkoolaide | 9 hours ago
[0]: https://vallumfirewall.com/
Saris | 10 hours ago
1970-01-01 | 13 hours ago