My favorite game too. I'm fine with the old graphics. Anything new would probably butcher it. There is a remake that replaces the engine but keeps the models, it was posted here a while ago.

End year sales are common. Black friday, Christmas whatever. People spend and taking profit feels good.

It's probably a way to get phished, if you click on a malicious bmp file.

MSRC[1] says otherwise:

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

I don't know anyone running Paint servers and I'm pretty sure phishing could be possible.

It's bizarre that you're doubling down in the face of statements from Microsoft's security experts who have the full context of the investigation and the source code. It's worth some self-reflection on what drove you to make this post.

The boilerplate FAQ text is frequently wrong or incomplete. You can go through the catalog and look through some of them and see how many have multiple revisions. I think, if you want to know definitively, you have to patch diff it

Where does it say that you can't be phished with a bmp file?

Maybe you should self-reflect on why you are offended by my comment. You might learn something about yourself.

It says that "no user interaction is required", so phishing is explicitly not what this vulnerability is about.

You haven't declared any privileged knowledge of this attack or MS Paint and have, on vibes, doubled down on what you assume must be going on despite other evidence.

It's a bad look.

Look away then.

You don't have to comment on other people's comments you know.

Phishing with .bmp files existed for a very long time now.

> Maybe you should self-reflect on why you are offended by my comment

A significant chunk of the world's problems today are caused by or exacerbated by people who confidently assert things they believe regardless of what evidence or experts say, and who dismiss expertise. Those people are emboldened by others allowing them to spew nonsense unchecked, and I have no interest in seeing HN degraded similarly.

You're moving goalposts. A commenter asked what Networking MS Paint had in the context of this vulnerability. You made an assertion not supported by the documentation we had, and now you're trying to claim that there could be other vulnerabilities rather than admitting that you made a mistake without doing any research.

Arguing on the internet over these kind of things is not a very good look.

Was this exploited in the wild?

On android they fall down along the side all the way to the bottom

There are always more left.

And memory safety doesn't prevent logic errors (or using 4 as a private key for that matter)

No, but type safety does. You can't forget to lock an object before using it when that lock is part of the type. Or pass a raw user controlled path to a function that expects a validated one. If you want to do it on purpose you need to write unsafe code that's clearly visible to anyone reviewing your patch.

This said memory unsafe code just likely has more bugs because of all the footguns it has on top of all the other security work you need to do with it.

They can tokenize AI tokens to speculate on futures or offer options

"Disaster has been averted"

Yeah, hmm a lot of people don't actually auto update their PHP so.. it's not like the vulnerability disappeared from the wild.

My approach has been that I architect a system myself that is modular and the agent tackles one module at a time. If the module does not work it can be ripped out and replaced without effecting the rest of the working modules due to strong decoupling. This way I may ship code I don't audit but when I have to the issues are already easy to find. And of course document and unit test everything.

So I don't cognitively surrender the system design, only the inner implementation of the modules.