Hacker News Reader

Comment by bsuvc | Hacker News Reader

I haven't used Notepad++ since they were exposed for having a CIA backdoor, which they "fixed" after it came to light.

https://notepad-plus-plus.org/news/v733-fix-cia-hacking-npp-...

It is not Notepad++ fault. Essentially, the CIA made a modified version of a DLL included with Notepad++ that contains a backdoor, but it is not in the official version of Notepad++ and you can't get it by normal means.

The fix is just an improved signature check, so that Notepad++ detects if that DLL has been tempered with, by the CIA or anyone else, or by a virus. But as Don Ho himself said, it is a rather weak protection, for that specific attack. Notepad++ is free software, the CIA (or any malware author) can make a version with Notepad++ with a backdoor and there is nothing the author can do, it is true for all free software, and most proprietary software too.

But Don Ho being Don Ho, and because it is the CIA, he had to make a rant about it. I don't like his attempts to push his political opinions with Notepad++, but that's his software, his rights.

> I don't like his attempts to push his political opinions with Notepad++, but that's his software, his rights.

His opinions are pretty much just ethical stances, so I have no issues.

You either didn't read your own link, or didn't understand it - NP++ uses a DLL that could be separately backdoored; the backdoored version wasn't shipping with NP++ installations.

You could in theory do something similar with literally any Windows application that links a DLL (i.e. virtually all of them).

The existence of a hacked DLL doesn't mean notepad++ had anything to do with it.

It doesn't matter. It was enough for me.

I don't understand. Once CIA has access to your machine, they can replace any DLL and have it be loaded by any software. You'll have to stop using all software with dynamic dependencies, why single out Notepad++?

Reply on news.ycombinator.com