It's a little more than just a compromised website. NP++ is the #1 text editor, and malicious actors were able to redirect update requests. It's a very serious supply-chain attack. I have a tab in mine that's just passwords and API keys. Bad and very sloppy practice? Yes, but I did it anyway and shudder to think what may have happened if Chinese hackers were able to work out which keys had value for them.

I have now cleaned that up.

Dipshit, Notepad++ has zero affiliation with Windows, and this vulnerability was part Notepad++â(TM)s server infrastructure.

> I rather wish notepad++ author would spend more time being precise in this sort of thing that actually impacts his user base over making sweeping political statements on things and then not give any fucks about state actors he pisses off attacking his user base.

Damn straight. Software engineers aren't humans, they're not allowed to have political opinions (like wars of aggression are bad- so political), and they should just shut the fuck up and keep providing and working on their free software.

Your sense of entitlement is amusing.

Well, that's the wise traditional rule - don't discuss politics or religion in polite company.

Which I suppose means /. is not polite company.

I would be fine with this if massive corporations and the oligarchs that own them would also halt all political speech, donations, funding dark money PACs, etc. Unfortunately, that is never happen.

Failure to take a overt stance on political issues isn't "apolitical". It's just aligning yourself with the politics of the status quo.

> While Notepad++ may be justified in this case, there are a lot of cases where they'd risk alienating half their customer base - not good for business.

What business is that, pray-tell?

Ya, I never understood how this was hard for people to grasp.

Kowtowing to China is literally just good capitalist sense. The dripping irony of people being upset by that is just bonus.

Genocide is a bit of a stretch, but if you look at it sideways, it's also not far from the early signs of such intent.

Complaining about the use of that word is valid. However, you went above and beyond and fed us a pile of CCP apologetic horse-shit, and you should be ashamed of yourself for that.

A German denying a modern-day early holocaust isn't a good look.

[1]Educate yourself. [wikipedia.org]

[1] https://en.wikipedia.org/wiki/Xinjiang_internment_camps

"That hasn't been hacked *according to the statement.*"

See what you did there ?

If someone was offended enough by it to launch a cyberattack, then it very likely DID have an effect. It is very difficult to spread any kind of message in China that is not explicitly approved by the government. If the author (who charges nothing for this software) wants to use his small bit of influence to get a message out, that's his right. If you don't like it, that's your right too. You're free to use any software you wish.

I would do that *if I was a mindless idiot who chose their text editor based on the fucking text editor's political position*.

But come on, there isn't anyone that stupid on Slashdot.

Is there ?

> Notepad++ was "calling home" to check if an updated version was available. It would "call home" automatically if you had auto-updater enabled, or if didn't have the auto-updater enabled, it would "call home" when you clicked the button to check for updates.

> So what exactly is your issue with that behavior? If you don't think an application should "call home" to check for for new versions, where exactly do you think it SHOULD check?

Software should never call home and certainly not itself check for or install updates of itself. Users should perform these tasks as necessary OOB from application software.

People are creating massive houses of cards with these continuous automated updates that cost the vendor nothing but which continuously expose users to unwanted changes, bugs and security risk.

And the call mechanism was hijacked and used against users. Great stuff. If it didn't call home... I could still check for updates myself, and download them myself, and install them myself, just like I did the first time.

I am not the OP, but perhaps each vendor should not have to architect this function, since it is such a high security risk. Instead, use infrastructure like apt, yum, chocolatey, Windows Update, Steam, etc.