News for hackers. Stuff that matters.
Re:Windows Notepad App Remote Code Execution Vulnerability by TonyTrapp on Wednesday February 11, 2026 @04:03AM (#46972609)
Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.
Re:Windows Notepad App Remote Code Execution Vulnerability by pjmlp on Wednesday February 11, 2026 @04:25AM (#46972784)
The reason being it is a plain text edit component, with a window around it, hence the limitation.
Re:Windows Notepad App Remote Code Execution Vulnerability by zabzonk on Wednesday February 11, 2026 @05:25AM (#46973262)
Yep. Back when I used to teach Windows programming in C commercially, the course exercise was to replicate notepad. It was surprising how many of its features you could implement in a week-long course, especially as many of our clients were no great shakes at C.
Re:Windows Notepad App Remote Code Execution Vulnerability by NetMageSCW on Wednesday February 11, 2026 @07:32PM (#46983296)
I think it is more surprising how many deeper features were hidden in Notepad (I did a complete re-implementation using MFC for Windows CE).

Did you implement .LOG and Unicode support with BOM handling?

Re:Windows Notepad App Remote Code Execution Vulnerability by zabzonk on Wednesday February 11, 2026 @08:08PM (#46983625)
This was on Windows 3.1. I don't think the version of notepad there had any Unicode support - certainly the one in our training course didn't; I didn't feel up to teaching C, the Windows API _and_ Unicode. It was just a slightly realistic exercise where our clients could implement as much or as little as they felt happy with, making use of standard windows controls as much as possible.
Re:Windows Notepad App Remote Code Execution Vulnerability by SomeUserName432 on Wednesday February 11, 2026 @04:36AM (#46972874)
I find notepad useful for sanitising clipboard content.

No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else.

Ala Cmd+Shift+V on Mac

Re:Windows Notepad App Remote Code Execution Vulnerability by setopt on Wednesday February 11, 2026 @04:46AM (#46972955)
I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.
Re:Windows Notepad App Remote Code Execution Vulnerability by EE84M3i on Wednesday February 11, 2026 @05:43AM (#46973383)
I explicitly stopped this habit so that I don't accidentally do it with sensitive data I don't want to go to my search engine provider's auto complete API.
Re:Windows Notepad App Remote Code Execution Vulnerability by theandrewbailey on Wednesday February 11, 2026 @06:38AM (#46973711)
Disabling remote search autocomplete is one of the first things I do when I setup a new browser instance. It's a privacy and security nightmare I don't want.
Re:Windows Notepad App Remote Code Execution Vulnerability by masfuerte on Wednesday February 11, 2026 @08:39AM (#46974812)
Same here. And I just noticed yesterday that Firefox had added and enabled a "Suggestions from sponsors" feature. Which I've now disabled, but presumably it's been sending anything I type into the address bar to Mozilla since 2021. I am tired of Mozilla but Chrome is very much worse.

ETA: I only noticed yesterday because a "sponsored suggestion" popped up when I was typing, which I've not seen before. So either they actually enabled it recently, or advertisers don't bid on the kinds of things I usually type.

Re:Windows Notepad App Remote Code Execution Vulnerability by iso1631 on Wednesday February 11, 2026 @09:46AM (#46975586)
ctrl-k is for the search box

ctrl-l is for the address box

At most I want the address box to do is look up a dns name. Which can still be a risk if I were to hit "enter" with sensitive information which could in some cases get pushed out to my DNS provider (which is me, but then it's possible the address would be pushed out to another resolver, and will also be logged in an unexpected place)

Re:Windows Notepad App Remote Code Execution Vulnerability by 8cvor6j844qw_d6 on Wednesday February 11, 2026 @12:40PM (#46978108)
> Disabling remote search autocomplete

I've always have a suspicion that even with auto complete off, some sort of telemetry or obscure feature is still leaking browser address bar text.

Re:Windows Notepad App Remote Code Execution Vulnerability by HugoTea on Wednesday February 11, 2026 @05:45AM (#46973398)
I do a similar thing but use the start menu search, Ctrl-C, WIN, Ctrl-V, Ctrl-A, Ctrl-X. You can do it all in one hand and can get really fast, assuming the start menu doesn't lag behind. There's also the downside that it publishes all of your clipboard content to Bing search so maintain vigilance for confidential data...
Re:Windows Notepad App Remote Code Execution Vulnerability by andhuman on Wednesday February 11, 2026 @06:37AM (#46973700)
Have you tired using the run action instead to clean the data? Win+r
Re:Windows Notepad App Remote Code Execution Vulnerability by jasonjayr on Wednesday February 11, 2026 @08:08AM (#46974500)
This reminds me of the 'spacebar heating' xkcd: https://xkcd.com/1172/
Re:Windows Notepad App Remote Code Execution Vulnerability by BuildTheRobots on Wednesday February 11, 2026 @03:39PM (#46980587)
I've been using Win+R to paste it in the windows run box.

Amazingly still works on Win 11 and still seems to keep it local (bypassing the windows search), so I'm pleased to report consistent results for 30 ish years.

Of course, now I've mentioned it out loud, it'll be the next thing to go...

I don't know if it's just me being old and grumpy, but everything windows 8 and later (server 2003) seems like half-baked, unfinished enshittification. Trying to do something even vaguely "advanced" to a network adapter puts me back in windows 95 land along with the run box. The "manage" pane with device & disk manager and logs is from a totally bygone era yet it seems to still be the only way of getting that information. The worst bit is, I'm not complaining. All the bits that look and feel like they've been forgotten since Windows 2000 are the easiest, least infuriating bits of the system I interact with.

Re:Windows Notepad App Remote Code Execution Vulnerability by zzrrt on Thursday February 12, 2026 @03:09AM (#46986104)
I use Edge’s address bar to de-wrap long URLs that have line wrapping and indentation in a proprietary packaging system’s SBOM. I paste in, then copy out the unwrapped URL to another application.
Re:Windows Notepad App Remote Code Execution Vulnerability by xnorswap on Wednesday February 11, 2026 @04:39AM (#46972897)
You can Ctrl+shift+v to paste plain text in windows.
Re:Windows Notepad App Remote Code Execution Vulnerability by sheiyei on Wednesday February 11, 2026 @05:06AM (#46973123)
In some cases. In others, the application does whatever it wants.
Re:Windows Notepad App Remote Code Execution Vulnerability by UqWBcuFx6NV4r on Wednesday February 11, 2026 @05:17AM (#46973214)
And funnily enough, Office for Mac doesn’t allow you to do this, or at least it didn’t used to. I think I may’ve just noticed that it’s started working.
Re:Windows Notepad App Remote Code Execution Vulnerability by mfro on Wednesday February 11, 2026 @08:20AM (#46974612)
Doesn’t work for me. The absolute most infuriating thing is that copying text out of OneNote pastes as AN IMAGE. The only way around this is sanitizing the text in a notepad on the host machine itself.
Re:Windows Notepad App Remote Code Execution Vulnerability by 8cvor6j844qw_d6 on Wednesday February 11, 2026 @12:34PM (#46978013)
> application does whatever it wants

Obsidian has a mildly infuriating default of opening previews with ctrl shift v keys instead of pasting with no formatting.

Re:Windows Notepad App Remote Code Execution Vulnerability by SoKamil on Wednesday February 11, 2026 @06:38AM (#46973707)
I always used browser address bar for that. But giving it a second thought, I uploaded the data to Google servers.
Re:Windows Notepad App Remote Code Execution Vulnerability by prmoustache on Wednesday February 11, 2026 @08:28AM (#46974695)
I have my firefox browser configured to keep using a separate search field and not make search queries in the url bar. It annoys a lot my partner if I let her use my computer to check something but it is frictionless once you unlearn bad habits.
Re:Windows Notepad App Remote Code Execution Vulnerability by d3Xt3r on Wednesday February 11, 2026 @04:27PM (#46981286)
I use the Run dialog (Win+R) for this.
Re:Windows Notepad App Remote Code Execution Vulnerability by hsbauauvhabzb on Wednesday February 11, 2026 @06:51AM (#46973824)
Win+r, ctrl+v, ctrl+a, ctrl+x, esc does this without spawning a non ephemeral window
Re:Windows Notepad App Remote Code Execution Vulnerability by d3Xt3r on Wednesday February 11, 2026 @04:28PM (#46981307)
Unfortunately this has a 260 character limit.
Re:Windows Notepad App Remote Code Execution Vulnerability by hsbauauvhabzb on Thursday February 12, 2026 @05:24AM (#46987016)
Interesting and valid point. TIL!
Re:Windows Notepad App Remote Code Execution Vulnerability by literalAardvark on Wednesday February 11, 2026 @05:03AM (#46973104)
Notepad is so slow at loading large files that it crashing quickly is a feature.

The windows 7-10 versions that could open anything would just get stuck for half an hour when you opened the wrong thing in them, which was rather annoying.