Notepad++ supply chain attack breakdown

Re:Notepad++ supply chain attack breakdown by rectang on Tuesday February 03, 2026 @06:45PM (#46879131)

There's a subtlety that's missing here: if your threat model doesn't include the actors who can access those backdoors, then computer security isn't so bad these days.

That subtlety is important because it explains how the backdoors have snuck in — most people feel safe because they are not targeted, so there's no hue and cry.

[ Parent | on HN ]

Re:Notepad++ supply chain attack breakdown by autoexec on Tuesday February 03, 2026 @07:07PM (#46879378)

The backdoors snuck in because literally everyone is being targeted. Few people ever see the impact of that themselves or understand the chain of events that brought those impacts about.

[ Parent | on HN ]

Re:Notepad++ supply chain attack breakdown by rectang on Tuesday February 03, 2026 @08:53PM (#46880386)

And yet, many people perceive a difference between “getting hacked” and “not getting hacked” and believe that certain precautions materially affect whether or not they end up having to deal with a hacking event.

Are they wrong? Do gradations of vulnerability exist? Is there only one threat model, “you’re already screwed and nothing matters”?

[ Parent | on HN ]