@donho said in v8.8.9 and ConfigUpdater plugin:

@PeterJones

It’s already fixed in the GitHub, but I didn’t make the plugin list cutoff deadline.

Are you talking about it?
https://github.com/notepad-plus-plus/nppPluginList/pull/999

It’s in the current PluginList in RC normally.

I ran:

Plugins > ConfigUpdater > Reset Validators Plugins > ConfigUpdater > Update Config Files

The open tab with ConfigUpdater.log no longer shows any errors

@donho
Good attempt, just for surety, why not ;-)

And I’ve to admit that I used to “abuse” churches too - in the summer it was nice and cool there and, most importantly, quiet, so I could study there and prepare for my exams :-)

@Terry-R @Lycan-Thrope

Otherwise on topic - there are IMO no complete atheists (in the sense of believing in something that is beyond my reach or ordinary understanding), everyone has their own faith. But while someone believes e.g. that gravity will still work tomorrow when they wake up, someone else believes in the virgin conception of the Virgin Mary, when the Holy Spirit entered her. For me, religion just parasites on and shackles the natural human need to believe in something better/bigger, something that gives human existence true meaning and a greater dimension.

@guy038

More good information. Thank you!

Barry

@Terry-R This has worked perfectly. Its a very long document so this was great. Thanks again, greatly appreciated.

@Eric-Wiseman said in Bug in sorting lines, staying there for years:

Line Operations -> Sort lines works ONLY if you convert Edit -> EOL Conversion ->Unix.

Unless I am missing something this looks like a bug…

As others have already explained, this is not a bug but rather a known and documented limitation, that all line endings must be the same.

If Sort Lines In Locale Order Ascending and Descending do what you want, those sorts implemented differently and are not dependent on consistent line endings. The ending for each line will remain with the text of the line it follows.

The Locale sorts can also sort using a rectangular selection for the keys even if there are tabs or characters of differing byte widths (such as can happen with non-ASCII characters in UTF-8) to the left of the selection, which does not work with the other sorts.

@Todd-Marshall ,

Some comments, based on your two most recent posts:

We had no way to know how exactly you used the AI – it could have been either of the following: you prompted it to “take a common problem found in Notepad++ and propose a solution” This version was why I suggested it might have been hallucination Since you didn’t say earlier, I had no way to know this wasn’t what had happened. you prompted it with "brace matching is not working for me in Notepad++, with details X, Y, Z. could you re-write this as a “proposal for improvement” This version was why I suggested that it was bad data fed into the prompt (ie, that you were wrong) This turned out to be closer to the truth, as you described. Both in regards to what you actually asked the AI to do, and with regard to the fact that you were wrong or incomplete in your description to the AI This was a lot of extra effort on your part. Instead of explaining to the AI what you wanted to say, and then have it re-write your text in its own words, you could have just explained it to us in your own words. And it would have been better, because it wouldn’t have introduced the AI-garbage uncertainty. And you wouldn’t have been violating the forums rules for posting. So it would have been better all around. Your posts don’t even match the AI text you posted. In your two most-recent posts, you claim you suggested Ctrl+D, but your AI text actually suggested Ctrl+] … that’s two different keystrokes. So by going through the AI intermediary, you didn’t even know what you posted. Re: Documentation: I have no idea what you mean by “mired in COIK” As the primary maintainer of the Notepad++ documentation, if you have concrete examples of how the Online User Manual is “poorly organized”, feel free to create an issue in the user manual repo with concrete descriptions… but understand that the basic structure is pretty set-in-stone at this point. But if you really meant, “I have been burned by other documentation before, so I don’t bother reading any documentation”, the onus is still on you to give each new application’s documentation a chance before rejecting it out-of-hand. I really don’t care about how good or bad the documentation for a major corporation’s huge flagship product is, and you basing your decision on whether or not to read any documentation based on a bad experience with a huge, gigantic application like that is rather unfair of you to any other documentation Re: the root cause being mismatched braces: you cannot really expect a feature that says “go to matching brace” to work as you described you wanted when the braces aren’t matching. And, in fact, the way that Notepad++ does work helps to indicate that the braces are mismatched, now that you know what that symptom means.

To sum up: don’t post AI-generated content in a Community of human Users of Notepad++; it’s not allowed, and it didn’t work well for you when you did.

@SammyBolt said in autoupdater and connection temp.sh:

Regarding the WinGup fix in v8.8.8, Was the temp.sh (or similar) exfiltration vector reported in v8.8.4 possible on a clean, official installation of Notepad++?

The temporary fix prevents the hijacking attempts that redirect to the domain other than github.com. However, it cannot protect against malware that is hosted on github.com.

The full fix will be included in the upcoming version, as mentioned below.

You mentioned the fix landed in v8.8.8, but can you confirm if this vulnerability was introduced specifically in v8.8.4 (due to changes in the updater), or were versions prior to 8.8.4 (like 8.8.2/8.8.3) also susceptible to this specific gup.exe hijacking technique? What about 8.8.5-8.8.7?

We still cannot determine the exact method used by the attacker. But it is not a case of “a vulnerability introduced in version X”.

For users currently running v8.8.4 who want to verify they haven’t been impacted before updating: Aside from monitoring network traffic for temp.sh, are there specific things we can check for, like modifications to the update xml file or other modified files/logs in the program directory?

I do not have complete information to provide specific advice. However, here’s an article from a security expert who appears to have investigated this issue:
https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9

My suggestion is download & install v8.8.8 manually from the official website.
The upcoming release v8.8.9 will be available in a few days. In this release the code signing certificates will be verified on the downloaded binary before update installation.
Then please update to v8.8.9, in which the vulnerability is fully addressed.

@h-jangra

It could be, yes, because I downloaded it and ran setup_arm64.bat in a normal cmd shell, and it worked.
But it could also be due to how you originally set up Rust. I also played around with this a bit, but couldn’t reproduce your problem.
I had MSVC installed via the Visual Studio installer, and then I installed the Rust toolchain. Some weeks later I add the arm extensions for VS and added the target to Rust, and it works for me.

@Ekopalypse I tried simple plugin now using go. It did worked, let see if I can improve. If its good then I should make template for it.

@h-jangra

I doubt that you can implement this in Scintilla in a reasonable way, but the other idea of having a preview is there, and there are at least two plugins, here and here that can give you some ideas.

@PeterJones I think I found the culprit behind this.

Looks like I had my Avast autoupdater to ON, and probably it was the reason behind quiet updates for both Notepad++ and my Mozilla Thunderbird 42.

It became a routine for me to reinstall old versions over and over and over agian.

Thank you for your response.

Really appreciate your help and detailed approach.

@PeterJones
Thank you for the reply. Yes, I understood that inference. I was hoping there was additional tweaks to try. Yes, I could do a reply. It was triggered on a very minor edit. Maybe the site support would be interested in the issue. But it’s not important to me now.

@deleelee

Thanks for the pic. You are evidently using the MenuIcons plugin and it seems that this plugin has a problem with the N++ v8.8.8+ new tab-label length limitation feature. You can try to report/ask for help at that plugin site:
https://github.com/francostellari/NppPlugins/issues

or disable its “*” tab marking feature in the Menu Icons Options settings (select the “No symbol” radio-button there).

@PeterJones

If you are using one of the built-in themes, you might try to compare your %AppData%\Notepad++\themes___.xml with the version from c:\program files\Notepad++\themes,

I don’t have a custom theme; I just use whatever existing themes and modify them (just two, really). I just replaced my %AppData% theme with the “program files” themes, and the colors look okay again.

795725ad-50a6-4d40-a0cf-308501ed7cea-image.png

But both your margins being light gray imply that your theme was missing both those definitions when you ran 8.8.9 for the first time.

I am pretty sure that when I installed Notepad++, I just copied the old saved themes over, which is why the new styles were probably missing.

In this screenshot, I set one to Bookmark to salmon and Change History to yellow, to make it obvious which was which.

This makes it much easier to understand. Thank you!

Update: See our Change History Margin FAQ, especially the “How do I change the size” section, for an example of how to change the size using PythonScript or NppExec. (But yikes, I see that FAQ is out of date, since it doesn’t show the ability to change the four colors, which was added years ago… I will have to fix that next)

I am not that ambitious, but I am sure the update will be appreciated!

Thank you again, Peter. Not only did your post help fix the problem, but it’s also educational and shows me how dedicated people are to Notepad++.

@KingRustamus

I’ve encountered such stuff before and it was caused by the Windows ransomware protection “Controlled folder access” in action. (build in Notepad.exe works in such a case because all the Microsoft own signed binaries have a build-in exception).

So check (try to set temporary off or add a new Notepad++.exe exception there) the Windows Settings > Privacy & Security > Windows Security > Virus & threat protection > Ransomware protection > Controlled folder access.

If it doesn’t help, I can prepare a testing build of the notepad++.exe binary showing us exact system error code (and it’s not the ERROR_ACCESS_DENIED for sure, otherwise in the v8.8.6+ you saw the UAC-elevation prompt 1st) leading to this SaveFailed N++ messagebox.

@PeterJones

Thanks for pointing me to that Github issue. I somewhat researched the topic (using VS code/Electron) repos and added a suggestion there.

The issue, I think, is that instead of using a dedicated shell API, Notepad++ tries to manually launch an Explorer process.

@James-Burke-0 ,

Also, please don’t waste our time by asking the same question repeatedly in different ways. I told you this in early November, in this post, where I said, “instead of providing you a Save button…”, and went on to explain the same thing.

It’s very annoying to go to all the trouble of giving a detailed answer, and then to get proof that the answer is completely ignored by the person who asked.

@Jeff-Esposito

Hi, I had the same problem.

In my case it was (alsmost certain) caused by heavily editing the DarkMode-Default theme that got a size of over 500Mb. I Suspect it was caused by using many custom colors.

It has nothing to do with BitDefender. We have the BitDefender Endpoint Security running on our machines too.

Switching from dark mode Default to another theme completely solved the problem for me.
\Editing that theme with default colors did not slow down startup.
Give it a try.

Tip:

You can keep your personal theme by coping and renaming it. It will them show up in the themes
list. You can find the themes in C:\Users\Username\AppData\Roaming\Notepad++

Gerard Kiekens
(Key-Can Computer Services The Netherlands)

@bvklaveren said in sha512 certificate cannot be validated:

I have seen the instructions, but installing the self-signed certificate on all computers in the organization is not a practical solution.

Okay. Then ignore the self-signed, since there’s a commercially-signed alternative that can give you confidence that the binary is being distributed by the one who it claims to be.

It only takes one certificate to give the confidence, but it also means that you can ignore any other certificate on the same file, because having two certificates (one self-signed that you choose to distrust and the other commerically-signed which you choose to trust) gives you exactly the same amount of confidence that the binary is valid as does having just the commercially-signed certificate with none others. Whereas for someone who does trust the self-signed, they can choose to trust that self-signed and ignore the commercially-signed as being tainted by money.

Also, why would you include a self-signed certificate if you also have “real” one that can be validated without extra steps?

The “why’s and wherefore’s” are all available in the public, in various discussions on this forum (search for certificate) and the relevant section of the User Manual and in the various announcement pages in the official website. But I’ll sum it up, from my outside perspective:

Because for months, there wasn’t a commercial certificate available, because the corporations behind the certificates are set up to make things difficult to open source projects. And once he did get the new globalsign cert, he didn’t feel it was worth it to undo all the effort he had put into creating the self-signed certificate.

Lastly, it is not in the msi, so why is it in the exe?

apples and oranges?

The MSI is a container, which can be signed, and is signed separately from any EXE or DLL that might be contined therein. So the developer apparently chose to only sign that MSI with the commercially-derived – probably because his system was already setup to sign the EXE with both (because it was setup to sign with just the self-signed, then he added the globalsign cert on top of that once it was available), whereas the MSI didn’t come until a month or two after the globalsign was available, so he probably didn’t think it was worth the extra effort to figure out how to sign the MSI with the self-signed as well.

Since nobody here has indicated strong disagreement with my position, I’ve created an issue in the GitHub repo asking for this feature.

@MarkusBodensee said:

My expectation for the scenario would be, that using the arrow keys to move the caret, would also unfold and make the current position visible.

I agree with you that this is pretty confusing, and agree that using the arrow keys should have the same effect as typing. This would obviously be a separate feature request though, and as you noted I rather doubt that it would be accepted because it would only add confusion for some other users.