Why is Microsoft updating their text editors!?

0:00 Welcome everybody to the standup where we talk about the most important issues of our day and today We actually have two very special topics the first topic today is going to be on lines of code does your count really matter It does size matter or does it not and number two we have Casey Mirator giving us a full-on Presentation and or just walk through talk through about the no pad a plus plus Situation when it comes to what's what's it called all the vulnerabilities and all that and I think you might even throw in a little bit of Notepad RCE potentially at the same time. Don't know if you can do that. We have both pads both pads Not just the plus plus. Yeah, right. No pad multiplied by one plus plus plus

0:47 I don't think we're probably gonna have a lot of disagreement sorry for the people out there who are expecting us to really get angry at each other About this one. This is more that it's kind of like sometimes you go to the studio to get a little bit off your chest Sometimes called the stew by those in the professional biz, you know You just got to you got to say what you feel and feel what you say and get it out there This is just one of those where I felt like we just got to say it and I don't understand why everyone lost their mind for this like a year ago or maybe even like two minutes ago Everyone agreed Hey guys, it's a terrible metric to determine developer productivity to just say how many lines of code someone wrote in the last six months or in the last day

1:30 but Now all I ever see Mr. Gary Tann himself GT for short for those who know him in SF Don't get the Y 16 Z's Y 16 Z's that says for Y commentator boys With a Z because they're cool SF stands for sis San Francisco Josh played the song My it's like he he said he was writing so many lines of code it being so productive that he burned out his usbc adapters Right is not is not Did you find the tweet? I know you've got the tweet book please please tell me this was not said but I will find it and I'll display Give me a second. Give me a sec. That was not that please please someone tell me that was not a thing that was said in the real world Even by some minute Y Combinator, which I realize is a very low bar

2:18 No, the president of why the Y 16 Z's you're in trouble now, buddy. You're getting blocked on Twitter on that one Find some funding in the next three months when it comes don't I start up or you're screwed buddy never working this town again I'm never looking in this town again Sorry, but when I when I need to go When I when I finally have my growth hacking strategy for my new to-do list app I won't know where to go to get the fun. Oh, I didn't realize though trash I'm really sorry receipts is gonna have a hard time getting I'm getting funding I'm gonna try to call the IOUs from here on out I'm gonna try to get buddies. I'm amazing. I'm sorry What I meant is why Combinator's amazing my favorite place all the best people work there

3:10 Hey, is that HTTP get that out of here. That's not how we order coffee we order coffee by a SSH terminal dot shop Yeah, you want a real experience. You want real coffee. You want awesome subscriptions So you never have to remember again. Oh, you want exclusive blends with exclusive coffee and Exclusive content then check out Cron. You don't know what SSH is Well, maybe the coffee's not for you I actually do want to jump in on this one because I think it's gonna take it away It's this, you know, I think what ends up happening and I just just call me just call me crazy here is that the average person Thank you, T.J. I love that you made that joke everybody listening everybody loves that joke I'm sorry, we're not moving on someone needs to tell me if somebody actually said that they burned out there

4:09 Hold on gron I don't I don't know how to that part is but I do have a story about lines of code Yes, okay, just let me finish my lines of coding. Okay. Oh, by the way, yes, I found the tweet. Okay. I think I have it Here it goes. Okay, here we go. I'll just expose the tweet. All right It says this is it possible. I used cloud code so much somehow my USB connectors burned out of my MacBook Pro question mark Two of mine are dead and won't charge and now the third max is out at 15 watts Now I'm afraid my code Tomagotchi is about to die I just so so basically he's about to keep this tweet forever now I'm gonna put it on my super special meme site. I guess I don't want to say anything too specific here because I mean

4:56 I don't work with Mac books, but What is he imagining would have occurred like what there's a lot of Tocusing those connectors more Because you were using cloud code is it just because when he says burned out But is he is did he use those to plug into the network and he thinks that the like network packets were going so fast To cloud code or something I think I know what I can explain can I explain it?

5:23 Please I think I can I'm very confused right now is that Cloud code especially during that day, which by the way was just weeks ago used to use something like Terabytes of memory is what it would say on there and it was just always picking out everything and so my my assumption is that He was running such a heavy program and constantly having a CPU at like a hundred percent And having it charging that somehow the non-stop charging non-stop running of a computer Caused the charging ports to not work. That's like honestly. That's my guess. I'm trying to read into it But correct correct me if I'm wrong here again because this is not my this is not my area of expertise at all true But I thought max had a magsafe power connector and didn't charge over the USB-C

6:08 They do actually know in fact they do have the USB-C charger and the magsafe charger And there's also remember there is an in-between generation where they're just like or only gonna use USB-C And that's when they hated everybody and they thought they're max super cool And so there was a while that was just like three of them. I think that's it and that's all you know So basically what Gary Tannis saying here if so to be maximally charitable yes to the maximal charitable would be he's Meaming on us. That would be the which is possible. Okay. Yes That was a maximum. Sorry the maximally charitable technical interpretation Would be that it went something like this Gary Tannis clawed coating so hard for some reason

6:51 That because I don't know what he makes but he's doing something and he plugs in the power To one of the USB-C ports on the Mac and that is apparently able to supply power I don't know anything about how the Mac is wired electrically I've never even seen a Macbook pro other than the one I think that Anna had Claude code sucks down so much power for such a sustained period of time that it burns out that USB-C port But Gary's like that's not a problem because this thing has more than one USB-C port Unplugs it right He unplugs the cable from that port and he plugs it into the other USB-C port Which now I'm supposed to believe that all of these USB-C ports are all wired to the charging which doesn't sound like

7:37 How a laptop is normally wired but I'm just gonna go max work case you can plug it into any of them Yeah, so this is like just because hard crap engineering plugs it into the other one He's like awesome now I can get back to making this to-do list app that I was working on No, it was actually called Gary's lists. All right. That's actually what he was making is a little bit different Ironically it was called Gary list. Yeah, I was what it was making. Okay, so it's making Gary list He was like I as I just need cloud code to just please please finish this Gary list app just suck down enough power to finish Scariest this app so I can finish recording the fact that my wife left the fucking dishes in the sink or whatever it is

8:15 so he He has it in there and he He does it again and it burns out again and now he's like there's only one explanation for this Claude code fried my ports. That's this is the what the that's what we think happened Yeah, that's that I like the interpretation of it was that he was running his computer non-stop Which I also run my non-stop like I never turn off my computer and it's just always plugged into one so somehow yeah Yeah, but okay, I'm juicing all right to be fair. Maybe I want to say this You don't have the token flow going over those ports like he does and that's a white boy catch the flow like they can they cannot Okay What I see because the tokens flowing is even more powerful Than electricity think about that. So I think that's the it's just an unprecedented amount of power through the USB C

9:09 It was not rated for this level of intelligence That's right you when you buy power cord through have to now check the intelligence level because that's how you know if you can handle that level It can only handle up to GPT-40 after that this this bad boy burns out What's the ex what's the x.com account? So I want to check because you're saying I get blocked I want to know if I'm already blocked. I bet I was already blocked. It's scary with two are No, he wants to know if he's blocked. I know I'm just gonna give him like the exact tweet and everything and he GT follows me. What's up GT? Oh actually? Wow really GT follows you. I'm a much I'm a nice person on x.com everything application if you're not

9:54 To everybody on on x.com. I say like almost nothing game That's not true. Okay, so I'm posting this into the studio chat. I can't tell you That's why if I had an app I would have loved it and I would have told you see Exactly case-and-point my last thing that I said that was mean as I said Claude Opus is trash But I did this photo, which is actually making fun of people who are Perennial thinking that every single every Single like new model makes all the other model trash and like this is what I imagine the person looks like It's just constantly like oh a new one came out. Actually everything else was trash before this and that's kind of like I was actually that was a meta joke Okay, see I didn't see where I'm check check a check your tweet check your x.com. I I

10:40 I added you Yeah, turns out. Yeah, yeah Porfella I Was already I had nothing to lose he already blocked me at GT in the y16 Z's They don't like it Casey. No worries. I would see that tweet nothing on the line Yeah, all right, so let's get back a little bit to the thing Let me tell you why I think lines of code is happening So my my big grand theory my unified theory of the universe is this is that the average developer I mean, I've been around a lot of developers when they're programming they they look at code for an exceptionally long period of time And then make some changes and they don't have that editor flow. They don't have a lot of hot keys memorized It's actually it's an it's why I hate pair programming it just makes me want to cry and so when I watch all these things

11:34 Happens just like holy cow and now they've been given a cannon in which can make changes in rates in which they've never had And so now lines of code went from oh, that's not a meaningful metric to look how meaningful it is because now their life has completely changed And this does represent at least a good portion of the developers even if we assume that everyone beyond five years of experience is an Expert programmer that is maximally efficient the majority of people are gonna still be pretty slow Not that because they have five or less years of experience Especially after like the great wave of incoming people So I think that we just have a huge amount of people that have come into the industry in the last couple years

12:07 And now like magic has happened on their rate of production and so it's just I hadn't I hadn't considered this angle of it was something We used to measure before and most people couldn't get a big number just like Right either from physical skill issues or for good ideas or like they just don't have enough code in their code And so everyone's like well, we don't want to measure that because I can't even get a big number even if we could That's right, but now they can get big number and I forgot big number good up into the right good as Casey who has said what we got on the call But up into the right it's good. So okay now it all now it all is becoming very clear to me That's that's a great point. I do I do think there's like a lot of that kind of thing going on because basically like what the a I

12:53 sort of what the what the AI era has taught me is that literally everything anybody ever said about programming That was critical of something that I previously was trying to argue for they actually none of those arguments They actually believed those were all just things they said because that's how they were writing code and the instant that they changed to writing code A different way all those arguments go out the window whether it was lines of code or the code should be readable or any of those They're just like nope because now I use this other tool and so now I'm not gonna all those things that I was arguing before but why I couldn't do this Good thing you were suggesting that I do Suddenly those arguments don't matter anymore, right?

13:33 And so I think like that's been the most annoying part of that Whole process was like yeah none of it was actually true. They did they don't actually believe any of it They were just ways of Justifying and existing development practice that they didn't want to have to reconsider and the instant you give them a tool That makes it easier for them to do something else than the current easiest thing they were doing Then they'll do that thing and start arguing that that's the good way to do things No analysis necessary right like they it will they will not actually go Undertake some project to determine that it's actually better in some way They'll just start arguing for the new thing right. It's very disappointing

14:15 And this has nothing to do with AI being good or bad. There's a set there's literally nothing to do with the AI AI is not relevant here at all other than it's just the new thing like object oriented programming was AI can be good or bad And all the things I just said are happening regardless right So true true that I am fully convinced that if you could build a Basic routing system that really works well with the AI and it's fully documented And it takes no react and everything goes back to like say web components You know, which everybody says web components are the worst thing in the universe But if you could just go back to that and you're like oh yeah, reduce your bundle size by 60% And all these things happen and everything just works people be like yeah, everyone hates react

14:55 React is actually the worst It would just instantaneously term be like uh web composer actually we actually already had this because react is Every new major version has completely redone reacts. We've actually done this already. They're like class components No, that's lame. We're all about hooks now. Nope. We're not about or I don't remember what the order so we actually use the fact is the best uh No, you're not actually the hook on that situation play out like we already did that and everyone did yep We hate that we have a I have a quick related story about like uh like output, but this is pre AI. This is like 20 I mean not pre AI, but pre AI. We can't even what we understand it. How long exactly?

15:35 Exactly. This is like 2019. So we started in 2021. Okay. Okay. Okay. My bad. My bad. My bad. My bad. This is a pre AI So we had this app That we used that actually like tractor like commit rates your lines of code We didn't actually use it to like extract any meaningful data or decisions But we gave I gave access to it to my let my engineers cuz leading a team at the time I was like dude check out this like app and shows like where we all fall on this graph And obviously if you're up to the right you're doing better and everyone saw that they were like Kind of in the middle, but I tell you what after they saw that graph I haven't ever seen an engineering team work so hard Like it's the top right and it was actually like the best thing that ever happened

16:14 They're like where am I now coach? Where am I now am I on top right and every week they'd go look and be like yeah I'm at the top and they would just like code so like everyone's locked in these to all just sit around and talk But everyone's had their headphones on clicky clacky man. That was so cool. It was insane It was I was just like oh my god. They really want like they just gamified it like not even on purpose And they were just made it was insane anyways I want to share that wait so treasure you are doing lines of code is a good metric now I think pre AI if you just like if you don't actually use it for like making actual decisions You just look at it just for funzies But if that happens as a result

16:49 I think that's pretty cool like just like fun funzia fun fun Competition I guess I do it was it was insane to see Yeah I do feel like there is the the difficult thing for the lines of code discussion before though was like Okay, if you shipped zero lines of code. We do know you didn't do anything There is a metric like there's time and lines of change and it's just like oh you didn't do anything We know you're not doing something. Oh, he's only deleted a thousand but did nothing else your genius But like there's like this we are kind of Also heard hails that exist for people like do you just write docs full-time yeah Your negative lines negative lines of code is definitely a metric like if you if this for like how many lines of code to this

17:31 Person do this year. It's like negative 360,000. You're like okay that person is a freaking like double the salary Yeah, what I'm doing is like it's a principal engineer. Yeah It is nice to other thing now Well, I don't know this what's crazy is like I mean, I've been vibe coding a lot I've been vibe coding a lot lately and But I I see I don't really like calling the vibe coding because I actually read the code and also open my editor Like write things and then like tell it that it was wrong and stuff It is insane to me how many times If it happens to get unlucky in the search of the repo It will just start rewriting a thing that we have That already like It 80% these are not big repos yet by the way either this is like

18:19 Just tiny tiny repos not like anything that I would say like a real company has after two years or something right? They're like tidy and I'm like this is nightmare scenario stuff For like if you were trying to maintain something and you were like fixing some path and you thought you handled it Because you fixed the function with exactly the same name But then it turns out 37 other spots randomly in the code base it in line that same function at the top of the TypeScript I like oh no and they all have some variant of the set of fixers. They're not deterministic So they don't match you that one has 14 of the 22 fixes. We've needed to apply this one has Casey you saw this though. I actually am curious we should redo this again Casey where

19:00 I let twitch chat build something build a game and then Casey and I walked through the code together to kind of be like What did vibe coding produce like how was it and it was a It was the experience, but it would be fun to retry because now everything has gotten significant Like we could all agree that the models have gotten better I just it's foolish for people not to say those things. So it's I'd be curious What is the practical implication of vibe coding now versus a year and a half ago like is is it actually dramatically better in in practice or is it partially better?

19:30 That's not right. It might be interesting for you to try it too because you never really got it to produce like a working like it didn't really work either So like Chussi 3 was actually really good game and I would like you to take that back Please that out Because you know you were asking it to kind of make like a ray marcher and It never really quite was able to pull that off and so the anime way to see if the new ones can just do At least if the new ones can at least do you know just make A repository that at least does that minimally right?

20:07 Yeah, yeah, yeah, I'll do it this or next week and we'll we'll do a low code review. It'll be a fun time Anything else on the lines of code just guys this is this was like I said This is a chance to just get it off my chest I just have to feel like don't let it be a metric for how much stuff you're shipping at work Like if you want to maintain the software and be able to use it again in the future Even if a eyes get a hundred times smarter. It's actually still good for them to spend less tokens So if you're like hey, like I've spent a lot of money on on vibe coding while other people's money Showed off. Thanks cursor for the free credits anyways Um, I spent a lot of cursors money on credits in the last two weeks

20:50 I've been telling me about his spending half as with cursors They got me looked you guys gonna you guys get any more of them credits. Yeah, he's got any more of them Grids um The It is actually like let's say you think we're gonna spend a bunch where uh do more AI driven stuff blah blah whatever like okay But then the baseline thing you're spending is tokens So you actually want to make sure that you don't have an extra hundred tons of lines of code in your code base That the AI has to read and process and figure out what they do and check all the places and spend tokens on that It's like actually still bad even if you're an AI maxi. So I don't understand guys. Don't do it Just be on the lookout for that try and get some PRs that are red

21:32 Net net removals. It feels good too. You'll be happy at the end of the day So that's I just had to get that on my chest get it out in stew. Thanks guys No, you're actually shockingly right on that one even I don't Wow But it's actually a great astute officer. Well tea date you come on you know that sometimes you mean a little bit But the future side of it is really good which is even if you get 10x the more context A big code base is actually way worse. You will spend so much money. Like you don't want big context. Okay I know right you look all the people excited about that. I'm not excited about it Open AI loves big context and it cannot lie. Okay, but you You the guy footing the bill for open AI you don't want big context

22:20 You want it to be small and more self-contained and obvious and it works nice So that you don't have to spend 200,000 tokens you guys to the first prompt you guys don't know anything You don't understand vibe coding None of that truth You don't know what you're talking about all you have to do is buy like 12 Mac minis guys And then that's it then you have all the car you just keep buying Mac minis and plug them together And then basically that's all you then knows no more payment So I'll run it on the Mac minis Not sure you burn out both power both USB power cables and Gary Tans got to go to the best buy to keep his tokens I've got actually I've got extras right here. I've got here. I've got extras

22:59 I got back right away. Those those are not rated for for five What is your level? This is some this is some kidney k-cores man No, there's a teamy k-cores get those out of here I have this in my head. I'm imagining Gary Tans like at the best by going like Do you guys have any like power cables that don't like burn out when you're running Claude code on your Mac book pro?

23:22 I need the AI section you guys have an AI section that best buy if I'm if I'm doing Soono and generating music do I need this one? Yes And the vacuum tube a vacuum tube teach if you really want that warm analog sound. Oh, I don't have that. Sorry I didn't yeah, I don't even know with them. I was really hoping you were going to say something random that I might have around my desk I Have so many cores really coming from Trash I've got treasure unlike you. I don't have 10,000 dollars of Pokemon cards right behind my desk I have only other like I say that and I looked over and I have this If you say teachers like I don't know a good list dollars of Pokemon cards, but I have a 10,000 dollar marimba in my rooms

24:06 It was not $10,000 but with inflation maybe Okay All right, a long time ago. Do we want to get to the main topic this yes, please It made topic 40 minutes in yeah, all right So today on the stand-up we are going to have Casey Miratory give us the lowdown on notepad and no pad plus plus if you are not familiar There has been some big news in both of the old pads And so Casey yeah, aren't you taking I mean big big news might be saying a little bit much They both had security exploits is really what was kind of weird and the reason Normally we probably wouldn't be talking about it if it weren't for the fact that it's kind of just getting absurd now that like both of the notepad apps for windows both had security exploits like the last 12 months

24:55 Which is just kind of a little bit weird and you're just like how we how we got into the place where like the text editor is regularly having security exploits So I'll start with regular notepad which is just the one that comes bundled with windows That's the one that you're probably most likely to use because it comes directly from Microsoft and you don't have to have installed it It's just going to be there, right So this one's kind of nuts and actually I'm sort of glad that I read up on this one because I didn't actually know This fact about windows I Maybe could have guessed it had I thought really hard, but I might not have because I might have been like well surely no one would do that You wonder make Microsoft my friend and I was like okay, I guess uh yeah less and learned so anyway

25:44 So what happens is uh in notepad nor in normal notepad now they have sort of started adding features Which is exactly what you don't want someone to do to a notepad right like the whole point of notepad is just this like really crappy Text editor and you can kind of breathe a sigh of relief when you fire it up because it's just not going to do anything right So you kind of would have hoped that like oh if I'm going to open this file Nothing could possibly go wrong because it's notepad it doesn't have anything in it can't do anything It's fine, but they've been steadily adding features to notepad so now that's not true anymore It's got copilot integration and all this other stuff now that's what I need

26:19 Yeah, so now if you open up notepad it's like anything goes It's just like opening up Microsoft Word or something who knows how much security Snap foods could be hiding So one of the things that they did is if you open a markdown file in notepad now Normally you'd think well, it's just notepad so if open a markdown file it's just going to show it as a text file But no it will actually do the markdown parsing in notepad I guess and now I have never noticed this myself I've never used notepad to open a market so I didn't even know it did that so apparently it does right And one of the things that it does when it purses the markdown file is that it properly obeys that like parentheses bracket syntax for linking where you can basically put in like here's a URL of some kind and here's the display text that I want for it

27:08 It will actually do that conversion and properly display that in the notepad so that you can kind of just click on links and they will you know it'll take you to the links Now here is where the problem begins the way that they shipped this feature is like So Casey are you okay? Do we need to like do we need like a personal chat right now?

27:38 Yeah, yeah, Casey I can make you feel a lot better. I actually do have a copy of the secure notepad. It's right here You couldn't you couldn't fit secure on one line no mistakes no mistakes Yeah, so the way that they they ship this feature Anyone that mo this will be lost on most of you but anyone who's been like a long-time Windows programmer they will be They will just they won't they'll have the face that I just had on my face. They will have that on their face too So the way that they ship this feature Was they do the markdown parsing as you would expect and they produce the like URL They they produce the like string the display string like you would in markdown and they take whatever the URL would have been

28:27 And they save just that raw string basically they just keep that When the user clicks on the link Literally they call shell execute ex w And just pass that trick How's that even passed like is it like security audits when they like do Yes, and it's hidden right you can't see what it is because it's it's hidden Yeah, I mean it's not going to tell you what it it's just going to pass it to shell execute just that's it right So it's just like they fill out you can actually go see that people have decompiled the code So they you can actually go see it's like yep, it fills out the shell ex W like info struct it sets the command to open and just just Blame the string is just there's the string like have a party

29:25 Open right So basically what this means is that anybody who You know was unaware because like normally you wouldn't think that's what it would do like normally you'd be like oh This is going to go to a web like this will go to a web browser and the web browser will interpret the URL So how risky could it possibly be it's no different than if I was yeah clicking a link on a website right no You can literally put anything you want in there like file colon slash slash the path to something you want to run And it will just run with your permissions on your machine right there no web browser necessary right I tried I'm trying in my head to come up with a reason why that happened and like I can't even come up with one

30:12 Well, I'm trying to come up with how it was allowed to happen I so so that's just in there right and the only real saving grace here so like that's really bad like that just should never I mean that's not There's people there's apologist who like replied to the tweet that I made about this who were like Well, I mean the user clicked on the link or I'm like no, no, I don't think you understand The user clicked on the link is true for every security exploit that's ever occurred like every security exploit Somebody at some point installed something even if it's the operating system And you can't be like well, they install an operating system on the computer So it's their fault that eventually it got hacked like no like except on the terms and conditions. Yes

30:55 So they're like the user is if the user clicks on a link It's the program's responsibility to ensure that it's going to just open the link at a web browser saying not Oh, that could just be Crap that runs on your machine. Can I can I ask a false that on the table right yeah, so Shell execute when it gets handed a URL that is a properly formatted HTTPS thing will just Launch a browser it had I didn't even That's kind of crazy. I guess I never really realized that you could just a protocol. Yeah, so show so so show execute Um, I don't know shall execute and I've never tried this method It's interesting to me that you can just be like here's HTTPS you know what to do That's just like yeah, I actually this is so so you could think of it as

31:41 That is the job of open so so when you do shell execute you can basically pass there these things called verbs, right Is actually verb in the same Sorry, sorry, sorry, keep going. I'm just trying a xdg xdga open Yes And the idea is this is you know, it makes sense and when it was created, you know shell execute The first time I remember it was in win 95 So it's it's been around like a very long time But the yeah But the i g x works in neo v impron. Yeah So the idea behind shell execute is very simple. It's that protocol handlers like people who know how to do something They can register those with the shell and the shell can go oh, you know, I You're someone called open and they gave me a pdf file

32:31 Who are the people who are currently registered to handle pdf files? Okay, let's open one of those and hand them this thing So it literate like this is its job. It's job is to take something like a url and Decode it into saying oh that I know how to open one of those Here's a program on the machine that can do that for me. So shell execute is operating as intended Now, obviously, this is a huge security hole Which is one of the reasons you generally don't want a program to just be calling shell execute on stuff If the user is unfamiliar with it typically like if you're gonna call shell execute You probably want to do a bunch of like hardening of that path to make sure that you've parsed the string yourself

33:09 And know that it's not something confusing right now. Obviously, this has been a security exploit topic before because And now we'll get to the really cool stuff So prior to 2024 One of the things that shell execute did know how to handle was Installer apps so MSI's just that just runs and installs crap here machine, right?

33:36 So you could with this exploit you could do ms-app install colon Some remote file and it will download and run it Now thankfully in 2024 Microsoft just removed that feature 2024 2020 well, you know better late than never to you Yeah, so now what will actually happen if you wanted to do the maximal version of this notepad exploit is thankfully Microsoft's other you know people who removed that will stop that from happening You'll get a box that pops up that says hey, I can no longer auto install things Please notify whoever it was that just drew the software that they have to update their installation like like yes good Very very good job That was good, right? And so that actually stopped this exploit from being potentially a lot worse than it was now

34:31 The other thing is one quick question. Can you just do like a like a curl You know some I don't know what they call at DOS scripts. I'm just gonna call bash for you know some remote script And then pass it into bash whatever the equivalent of that can the can you just shell execute that can you just shell execute a curl?

34:50 Uh, so you As far as I know and I guess I haven't thought about it too hard But as far as I know with with a single click meaning all you're gonna do is click on one of those One of those markdown parsed links and it's gonna pass something to shell execute The thing that it's going to do has to be resident on your machine So it would have to be like file colon slash slash something on your machine and it would run that okay But it can't with because they close that ms-app install so so a practical exploit for this exploit would have had to look like Hey, um, here's the github for our document collection no executables or anything right And you download it, but it does secretly have an executable in it

35:35 But you're never going to click on that because it's some buried in some sub director You'll never see or whatever right yeah Then the main page which is like hey table of contents with a link you click on that and it's got a file link to that executable and it runs it and then you're done your toast right because that's gonna run that executable with your permissions right away Um, so but without that ms-app install Because that loophole is closed now for shucks cute I don't think there was a way to have one click both download and run a program I could be wrong about that though But I don't think with a single shell execute it can do that It had to be something already read so it can either go get a file from the internet

36:12 Like by opening a web browser with one click or it could run a file already on a computer But I don't think it can do both together. I don't think People can correct me if I'm wrong about that though because I mean I'm not the person who reverse engineer this exploit so I don't know I'm just going by what uh security researchers Uh put up there and making my best guess uh but I did test it myself though. I went and ran. I made my own little shell execute thing Uh to see what happens if I did an ms-app install and I did verify that that is now blocked at least on my Whatever my current version of windows is that was running on this machine. I'm talking to you via right now Uh, it does in fact block this so that's cool now. I don't think

36:49 Unlike the exploit we're gonna talk about next I don't think this one was ever exploited in the wild because Microsoft found it So they shipped it and then some security audit or somebody who was going through the code or some research team That found it send it send it to them might have been what happened. I don't know Uh because there were reverse engineering of it online So it might have been that one of those reverse engineering people actually where the people reported it right I don't I didn't look to see who was the if there's somebody got a bug bounty for it or whatever I had canon as it's that somebody who is really mad that Microsoft is shipping updates to notepad internally And they're like I'm gonna show that you guys should stop updating this because I know for sure that you got

37:31 That's what I think in my head. I'm very positive guy inside is like stop updating this I bet tell you we just need an error. Yeah, the secure like someone on one of their harder course security Yes, it's like they did what to notepad all right I'm gonna go look at that and it was like what did you do? Yeah, uh For mention earrings on that. Yeah, I know he left a shell exploit in here. So yeah, yeah It like the entire security audit is just like grab shell Yeah, so that was that was the one that shipped with windows and fortunately again as far as I'm aware This was found by either security researchers inside or outside of Microsoft prior to anyone getting severely compromised by it So it didn't end up being an issue. I don't think that's my understanding anyway

38:24 Not so for notepad plus plus unfortunately Notepad plus plus Which I use by the way and have now uninstalled from my machines because I'm now terrified Um of even using a text editor anymore, which is terrifying. It's like I'm having a hard time emotionally thinking of Whatever teams in charge of notepad plus plus which hasn't changed from windows 95 all the way up until just like two years ago Whatever team that was that was in charge of it has started putting so many features into it including AI And I don't think they're ready for all the possible exports like I just don't think they're ready for it And they don't know what they're doing out there. No Notepad plus plus on the other hand Uh, this one is

39:07 Very scary Uh, the notepad one That I just said is more of like a Facepalm kind of thing. It's like guys don't show don't like we don't need to add shell executed Like just don't put shell execute in notepad ever like it doesn't need that right um But uh, yeah, so the problem is with notepad plus plus this is a different story Notepad plus plus is actually like a very sophisticated attack Attacking individuals. That's why this one's so scary. Oh cool. Yeah, and by terrifying would also cool story Yeah Okay so And I would preface that notepad plus plus is like it's you know, it's a something developed by just some folks, right Like it's not a commercial package. It's really not their responsibility to secure it

40:00 So at some level it's not that You know It's not like it's some somebody's fault for doing a bad job because it's like well they you know you They aren't even getting paid to do this thing, right? Like so it's like they're not necessarily supposed to employ a security team or anything else, right But it just goes to show you that like well if you're just using some open source software whatever it is It's like actually you might just want to be really scared about that because who the heck knows at this point What happened with notepad plus plus is as follows They unfortunately made the decision which I just wish people would just stop doing They unfortunately made the decision quite some time ago to have the thing have a auto update feature

40:44 Now thankfully it's not the kind of feature that's like you know chrome or whatever Where it just silently updates the binary like if you know if you have the automatically keep updated checkbox checked or something It just updates your binary whenever there's a new one or something like that Thankfully, they did not do that But what they did do is they made a thing called the win G or win G up or something like that Which they basically made their own little update Program their own little update sort of code base And they actually share it so you can use this you know This is something that other people could use as well And it's just an up there that checks a website gets an XML a little XML like

41:27 payload that says like what the latest you know um Download is so that can compare against itself and if it's newer it pops up a dialogue box basically that says like hey There's a new version of in this case notepad plus plus or whatever the win G up is running on There's a new version would you like to download it now right and you can click yes if you want it or know if you don't Thankfully Because I hate software updates for the past four years. I have always clicked no other people Who probably were also advised that they should keep their software up to date for security reasons Which is always a mix like the thing they don't tell you is the easiest way to get security exploits is to not update your software

42:14 And the easiest way to get security exploits is to update your software. So yep, right Um, so like you're damned if you do damned if you don't and this is a great example of that So Probably going like oh, I should make sure I'm up to date on my notepad plus plus clicked yes So this particular update or at the time didn't have any kind of cryptographic integrity check So for those of you who maybe aren't familiar with this kind of process When you are going to update a binary Typically what you want to do is you want to make sure that the binary that you're updating to actually is the binary that you think it is So for example if I install nootpad plus plus on my machine in in an ideal world what would happen is

42:58 I only have to trust the first time I got nootpad plus plus now obviously if the first time I get no bus It's a hacked version of it. I'm screwed. So maybe don't download the first version from the pirate bay or whatever right But once I have it installed What I would like is for that program to have what we would officially call like a public key That you know every copy of nootpad plus plus just has the same key When it wants to download a new version of itself what it downloads that executable It can check to see if that executable is signed in some way So that the binary itself actually matches When you do a signature check matches the public key that we have and only the people who can who produce the binary have the private key

43:45 So no one else can do it without actually hacking like the you know extracting the pub private key from this you know Where were the build farm and and that can happen too at which case all bets are off, but at least now we know Someone can't just you know hijack it And the reason that this is important is because if you think about when something goes to auto update It's just connecting to the internet to get that update If it's you know gets man in the middle like somebody sitting there and can intercept the traffic It can just go always try to download a new nootpad plus plus I've got a great node pad plus plus for him and gives you you know The the modified executable that has all the security exploits in it right

44:25 So anyway this particular version of nootpad I guess Prior to 2025 they just didn't have any kind of verification So they didn't verify the XML package and they also that you know came to say you know where you should get the new version from And they also didn't verify any executables that they that you would have downloaded as a consequence for that So this was just an insecure process And again, this is a there's a standard cve for this you actually go Uh, not cve there's a standard what what do they call it?

44:54 I don't know if you've ever if you've ever read I'm not security researcher If you've ever read those cve's which are basically like the thing that details what the exploit was From the mitre corporation keeps this them in a giant list right Um, there's part of the thing that the details the exploit there's like Codes that they have for what kind of exploit it was so they're like this is just a standard kind It's did not validate an update binary that's like it's just that's just like a standard thing right because it this has happened before So anyway, so that's the basic idea of what's about to happen and this so that part Well scary because it's like well, that's not great The scarier part is how they went about exploiting this because

45:39 A normal kind of exploit is a lot less scary than the kind that they carried out here So what they chose to do what the what the attacker is chose to do with it and they are believed to be state sponsored because of the level of sophistication Is they decided look if we start Randomly exploiting all of these that you know this backdoor to to notepad You know that's gonna get detected quickly So instead what we'll do is we'll pick high-value targets whose machines we were trying to compromise And we will see if any like of those IP addresses Connect to update notepad plus plus We'll man in the middle it because we figured out how to hack the web like we hacked the like the web provider Or someone in between the web provider. I don't remember the specifics are actually

46:29 Not as well documented as I would have the specifics of the hack are very well documented The specifics of exactly what the man in the middle part looked like we're not We man in the middle that we're just gonna wait we're gonna pass everything through so it looks like notepad plus plus is updating normally for everyone else But when we see a high-value IP comes in then we'll slip them the Mickey right then that and only that cup of coke gets the roofie right so What they then do is they serve just the high-value targets and updated notepad plus plus Mm-hmm that has and I love I love this it was I don't know if If hackers do these things to be funny because You know, I've never really known like a real black hat hacker

47:19 I guess but I know some people who are kind of like maybe adjacent to that and they do like inside jokes Uh in that way so I don't know So what it does is it includes a legitimate Copy of bit defender of some executable from bit defender a legitimate one That they have replaced some of the DLLs that it loads So they use an executable that is signed but that loads an external DLL So that they won't get security checked on that And they replace just the DLL it loads with the DLL that does the security exploit that they need Right so I'm like okay So they give you this package and Effectively what happens is notepad plus plus will update itself with the bad version that you sense It doesn't check it just starts running that you think you're running notepad plus plus

48:16 But actually you're running this uh copy of bit defender which they've actually renamed to bluetooth service So you're running a thing called bluetooth service with yes you're running this extra thing called bluetooth service That's actually a copy of bit defender that's that's Intact they haven't changed that at all But they replace some of the DLLs that it would have loaded with ones that have their exploit payload And off we go So this thing was like pretty hard to find apparently I'm not sure how the security researchers actually ended up doing it you could see You can go read rapid seven Has like their full breakdown of like how they went about finding it and it's like They had to find it on just there was a small number of machines that were having this happen

48:58 And they had to dig into it I guess because again like very few people had it So it's kind of like hair pulling of like wait What's going on and eventually they were able to track it back to the fact that it was notepad even though most People's notepad installs were not compromised right So at the end of the day this is kind of terrifying because it's like holy cow like I mean I'm not a high-value target. So I guess it don't really have to worry too much about that kind of thing But it's crazy just how Intentional these things are I didn't quite realize like how specific they might be and my guess is we have not found most of these Right like like this is not the only time they've done something like this. I'm sure

49:43 And what are the chances that we've actually detected most of them I That's interesting that they're able to man in the middle so thoroughly like that That's what I'm like most curious about is how how could you Like what kind of access do you need to have or what have you hacked to be able to do that just the web provider that happened to be running The the little win-ge update other end or whatever it is or not or the not the other end the We're the file the the web provider basically whatever they were hosting the notepad just had to hack the host That's it Yeah That's crazy and then they would just they would selectively pick which one is wild Yeah, well that's the thing is like yet like I just like that's what makes it so insidious is because normally like if somebody hacks a web host

50:32 Provider or hacks some website a bunch of people will get screwed but will know like that day Right because all hell breaks loose and like and security research are seeing weird files like they're monitoring all this stuff, right Yeah, whereas this they don't see anything Because they're not a high-value target Thank you. Well, they're presumably they know they try to figure out where all of those collection stasis are and Intentionally would never serve it to one of those right the hard part is finding someone high-profile using no plan Dang it. You took my joke trash. That's what I ask is Yeah, there's such thing as a high-value target using no Sorry, buddy. I said it already. Sorry, prime. I said it already. Sorry. Sorry. Sorry. Thank you

51:10 I thought I took it in there. I was like I gotta get this thing before someone else says it Trash Thanks a lot. I know I really appreciate that makes me feel great about myself I use it because I have to I make that materials or I want people to be able to use a text editor that they're familiar with if they can Just get for free on windows. Okay, you know, I'm not proud of it They're handing out no pet plus plus for free for sure now like guys How does it make you feel not great that when they Attacked high-value targets you weren't included like what's like what went through your mind that day? You know, it's getting up and up guys It's pretty don't know that they didn't try Casey's been clicking no

51:49 That's gonna say I was just gonna say I'm sure I was tops on the list prime of tops on that list And I just didn't hit up that they they were probably Furious That they couldn't get access to my machine with this tax probably the whole reason they did it and the other targets were just like to you know They're like well, we could since we didn't get Casey will get a couple get you know norad or whatever, you know There's like a cinematic scene that has Casey's face in the dartboard a guy just smoking cigars just throwing darts at Yeah, yeah, yeah, yeah, that's a chance They kept that exploit open. They were just waiting for Casey to hit the update. They were going going going going Yeah, no, man, we gotta we gotta get something back to the boss

52:26 Even though we're really here to get Casey but like all we got was Bill and it was like no big deal for my tea Yeah, first guy doesn't play mine sweeper ever and now he doesn't update his notepad. How are we gonna hack this guy? We've tried leaving us b's on the sidewalk he doesn't put those in his computer. We're screwed He's not even clicking markdown links in notepad. He's so free Everyone clicks markdown links. That's why they're there especially a notepad Specifically the world's most Markdown friendly editor that everyone knows about no bad Yeah, well now that it has cold pilot I do kind of think it is the best place to work with markdown documents prime I do like the idea of some of it Microsoft coming out and going

53:12 well The we have some good news and bad news the bad news is that the markdown parsing in notepad was attacked with a pretty significant security exploit The good news is since nobody knew that notepad parsed markdown to begin with no one was opening markdown files So we avoided any actual securities We like to call that at here at the big kind of shops like we operate at microsoft We like to call that swish cheese security, and so we're really confident We got so many layers of abstraction nobody's gonna be able to exploit our software Good news co-pilot has had no security exploits because nobody uses it and we will continue this nobody uses co-pilot So it can't get exploited do we know what happened to cortana

53:55 Where is she has I actually feel Yeah, and they replaced it with co-pilot and I also feel bad that co-pilot is the name of their office suite The thing that's on your desktop the thing that's inside of your no pad the thing that's on github and also the auto complete Like it does make it a bit confusing that get that they could have like one of them could have just been cortana You know I've got a question I've got a question for you If anyone internal to microsoft can confirm this for us before the next episode I'd like to get a guess from everybody How many people do you think at microsoft are still actively working on cortana because the answer is guaranteed to be more than zero I know it's more than zero

54:38 So how many people do you think are still actively working on a cortana related team at microsoft Well, so tj it's something so something you may not understand and and honestly it's I I feel bad for you Uh, okay, and halo infinite Cortana is like effectively kill So they did it because of that they did it for continuity and for lore Yeah, so that's why they go for tana introduced I would hate to refer to the halo timeline But AI's actually have a finite amount of operating time before they actually go on you just literally called a halo infinite And now you're saying it's finite. I don't not following it all what's happening That lore kind of sounds like the real world again See now see now you're really showing your your lack of halo a knowledge because infinite obviously refers to the USS

55:23 Infinite the major flagship ship that flies on halo five and halo ship that's infinitely big There may have played a little bit too much halo I Okay, I'm just Like have you read like the hey other novels? I have not read the books. I have not read the book That's what he says. I'm not what he said in deans Okay, he might be aiming me about him last week. He was telling me how much he liked the novels That's a one crime here's a like honestly real Talk here is it possible to have like a a brief you know five minute segment on the standup in the future where you Summarize the whatever chapter you just read from a halo Oh I'm just finishing up that hit strength this uh probably this week And so I could go into a halo book

56:12 I'll go into reach or something and then I'll give you like this week on halo Yeah, I would like to know and and we this is sort of like our soap opera serialization version of the novel that we can Okay, so we can all kind of be there with you. I just did all of Sanderson effectively So now I'm ready for the next set and so okay So I just I'm doing the one CS Lewis fiction book I haven't read Which is that hideous strength and then I'll I'll finish it all off All right I'm ready for it to heck yeah All right, so which halo book though there's like a lot of halo books. I guess you have to decide no idea I didn't even know there was a halo book uh Trash, there's books for everything now. I don't know if you know that there's always like shovelware novel. Yeah, like

56:51 Trash, did you know there's a show to go with Pokemon cards? Why You're kidding me Like look at this just so you guys know for halo books It does appear that there was at least five or there's six 12 18 19 of them and stopped and hit in 2019 With the official oh man, there's like an official book guide. Okay, we got a lot of books there I got a lot of books to go through. You don't have to read them all just one. No, you got to read them all. No hahaha I like it one but that's a lot of reading That be like a whole years worth of reading of halo books and I also read words out loud unlike TJ I respect the book and I get voices to each individual But TJ apparently did you know that TJ reads without reading the word in his head

57:41 What do that's pretty common? You don't have to say you don't have to vocalize in your head Yes, you do you need the like they all need to have voices and yeah Yeah, forms of speech like you got to give the art of the book. It's due. Yeah, man. I don't know how to read without verbalizing it in my head.

57:57 I'm over there like, hey, TJ, I can't look at it. Rans currently in Tanshiko and he's just like, I don't know what that is. Am I Tanshiko? No, that is not what happened. I never said it over to my lifetime. I don't know what you're saying. You say it differently than me is what we said. No, you say nothing.

58:11 You've just never said it. That's what you said. You're like, oh, I've never said I never spoke it with my mouth. There's a difference. Yeah, quick question. Can you sing a song and it's a female? Do you try to sing like a girl? Of course. Yeah, of course. What do you mean? The fairies yield, baby. That's what I was going to say.

58:24 Well, first off, trash. Boys and girls can both sing. We don't say that you have to sing like a girl. That's offensive in 2026. They're also good singers. OK? Well, you'd say first when they throw a baseball to or something, trash. That's a little offensive, OK? All right, all right. Oh, I can get through there.

58:39 I'm just saying that. OK, trash is a guest girl. That's what I mean. This has taken the worst turn out. Boys and girls can both sing, OK, trash. All right, in this podcast, Josh did not put that in here. Trash so many of that out. So many people out there on the receipts app just added what you just did to their district.

58:57 That's true. That's true. I like to. Terrible. No, I'm saying, I'm saying I still, I'm saying when we talked about it in the past, I don't know how you're going to say the words, because they're made up words. So some of them, I don't know how you're saying. We say them differently. But I don't sound out the words in my head as I'm reading.

59:17 Yeah, so you've never said them. Yes, with my mouth. Yeah, or your head. Sometimes I'm out of my brain. Or I've just never said them in my head or my mouth. And I'm like, yeah, so you've never said them. But that wasn't a conversation we had for that before. I, you said it in a really goofy way that I didn't think anyone could possibly connect English letters together to make that sound from those things on the page.

59:38 To be fair, I misread Murderall so bad. I called it a midriol. Like I was so far off. My case was so big, but it was a different one. It was a different one. What book are we talking about? Oh, that was a little time. That was a little time. A little time. Yeah. Also read that one. I read the whole series out loud to my kids.

1:00:00 How long did I take? Two and a half years. As long as I've known him. Yeah. I feel like you've even done a weird time since I've discovered prime. Yeah. Yep. Yeah, that was my fault too. Sorry, prime. Yeah. That was a good book. We were very happy. My son-in-talk liked it so much. He wants to re-go through it.

1:00:17 Though he is very angry at the end. Those spoilers for trash. He's just about to start. It's only like 15,000 pages trash. You got this. It's quick. It's easy. My dad already didn't have here if you really put your mind to it. That's true. I used to read the books like in a weekend when they came out.

1:00:32 So you could get him that. But that's just he doesn't say any of the words in his head. So he's omnie reading. I am read. I'm not omnie reading. That's vegan. He doesn't read anything. He's made up that he made up to explain why he can send him a text and nothing comes out the other side. Right. So if this is one of those things where like we see a new government report that's like unfortunately up to 37% of all high school graduates are now omnie reading.

1:00:56 Omni reading. Omni reading. Yeah. Right. A coin termed by a recent. Yeah. In Florence or Beganbot for the reason why we don't that we didn't we're not we don't have an illiteracy problem just to be clear what we have is an omnie reading problem. They're very different. They're reading everything at once or not at all.

1:01:17 And so it's kind of like they're really good at reading. We did such a good job that they can read everything slash nothing. Yes. Yeah. Well, thank you very much for joining us on this week of the stand up with me as always is TGTV trash dev and Casey Meertori. If you want to find out more go on Twitter and follow see Meertori follow trash with two Hs or TGTV TEEJ underscore DV or the stand up pod or the stand up pod and probably take talk.

1:01:48 Nobody knows Instagram X dot com stand up the stand up pod dot com all over the place. I got links now for Casey because I made the site. Yep. Also super cool stuff that's happening over on Spotify and I was just thinking that you know you keep telling me about how these hackers are state sponsored. We're always looking for new sponsors for the podcast.

1:02:05 It states also. There's a state out there. I was going to ask like Florida, Georgia, California was putting it on. Yeah. Yeah. I want to know. Yeah. South Dakota. If you want a state sponsorship. I got a podcast of South Dakota, a state sponsorship, the official podcast of South Dakota, the official.

1:02:26 All right. Bye. The end. I didn't know that joke was going to land or not. Some people was like, that's not funny. That's not funny. That's not funny. That's not funny.