Hacker News Reader

Looks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++"

https://github.com/notepad-plus-plus/notepad-plus-plus/commi...

View on HN

Yeah, that's trivial to bypass on a compromised machine without touching their binaries or hijacking system APIs.

To be fair, most things are trivial to bypass on a compromised machine. In fact what would even be the point of loading arbitrary code into Notepad++ on an already compromised machine?

The author of Notepad++ even said it, "It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC."

If CIA is already on your compromised machine and they want to target user of Notepad++, then they would just patched Notepad++ itself.

Reply on news.ycombinator.com