Hacker News new | past | comments | ask | show | jobs | submit login
Office Drama on macOS (objective-see.com)
160 points by LaSombra on Aug 12, 2020 | hide | past | favorite | 91 comments



What I find funny, is the quote: "Specifically we’ll show how we were easily able to [...]". And then the article consists of 3647 words :)

I'm actually quite amazed, and happy, how far security has come.


I write a lot of tutorials and guides and I strongly agree and disagree with this comment at the same time.

a) Yes, the words "simply", "obviously" etc are waay overused in this kind of writing and when editing it's often simply a case of doing a find and replace to remove them all (obviously after checking each one to make sure it still makes sense)

b) 3500 words is not a lot of text. Somehow marketing people managed to convince the world that a "long form" blog post is 500 words. In reality, 2000 words is often a ballpark minimum to say something useful and interesting, and 10000 word articles are often super useful (and still not that long given how easy it is to skim over bits of text, how fast text can be produced and how lightweight text is in terms of bandwidth and storage space.)


> obviously after checking each one to make sure it still makes sense

Did you?

> 3500 words is not a lot of text.

The comment was regarding whether it's "easy".


Yeah, but that's like 12 pages of text. 12 pages is a trivial amount to read for a step by step guide on how to own millions of machines.


It’s mostly images too, and the bugs are fairly straightforward to understand.


From Wikipedia article on the sylk format which the exploit uses.

> The format was introduced in the 1980s and has not evolved since 1986[2].

So over 34 years old.


Likewise, the macro format XLM — which the article notes is a predecessor to VBA (at which point I'm going, "VBA had a predecessor? but VBA is ancient — its still supported?!") — XML was introduced in 1987, 33 years ago. VBA wouldn't happen until 1993.

Absolutely incredible.


I used some early versions of Excel and am completely shocked the legacy macros still work. Article if you want to do some Win32 programming in XLM.

https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-...


If with "VBA" you mean Visual Basic for Applications, it had (AFAIK) several ancestors from the BASIC family including Visual Basic and Quick Basic. Probably GW BASIC and its ancestors count as well.


deathanatos seems to be referring to predecessors as a document macro system, not ancestors as a programming language


If you (are crazy enough to) do XLM programming then you will need this: https://github.com/xlladdins/xll/blob/master/docs/Excel4Macr...


> VBA is ancient — its still supported?!

VBA is well supported actually. The community is completely insular and they sometimes complain that they are second to C#, but there is support for the newest .net runtime. Kudos to Microsoft on this one (or not, depending on your opinion). The language changed a lot of course.


That it referred to XLM — that it is both older than VBA and still supported is quite surprising to me. (Given that VBA is no spring chicken.)


Lots of languages are ancient, supported and have predecessor. C++, Perl, Python. JavaScript.


All of those except C++ are younger than XLM. (And C++ has seen — comparatively — regular updates. XLM has faded into obscurity.)


To be fair, it's mostly a relatively simple text based variation of CSV that also encodes some cell formatting instructions. As a lowest common denominator spreadsheet data interchange format, keeping it stable is largely the point. You can think of it as a spreadsheet equivalent of GNU Recutils format.


Ugg..

I have macOS 10.12, and office from work. I get prompts to update word, which then tell me to update the OS...

Good times.

I probably should shift to libre office exclusively...


Ha! You are me, 24 hours ago, you poor unfortunate soul. Let me save you an hour of your life.

* Be me, 24 hours ago.

* Have the desire to find alternate word processor

* Find out that macOS support in LibreOffice, and another alternative OpenOffice, is an elaborate hoax similar to this function:

    func libreOpenOfficeForMacUsers(time:3600s, bandwidth:500MB) { while (time) { time -= 1; sleep } return poop }
Basically, running the apps on macs using retina displays (intr. 2012) results in 100% CPU usage when scrolling even on a blank page, presumably due to a bug or an extremely inefficient update/drawing method. This has been an issue for 8 years.

Bug link for LibreOffice https://bugs.documentfoundation.org/show_bug.cgi?id=113104

I downloaded and tried out both LibreOffice, OpenOffice. The result was 4fps while scrolling or resizing windows, and of course there was the expected extreme heat generation and 100.0 energy usage in activity monitor due to max CPU usage. [My mac is MBP2020 w 5600m, and yes I love it A LOT!]

* Back to the drawing board. Markdown, perhaps?


I believe that if you do "Get Info" on an individual application, you can disable Retina rendering for it. The OS will render it with the full non-retina code path into a non-Retina-sized buffer and then upscale it to fit on your screen at normal size (but with terrible resolution, of course). May help.


Have you tried iWork?


I use Pages as my go-to word-processor and Numbers (on account of its table-in-sheet paradigm) is my favourite spreadsheet by far. I wish they’d beef the latter up a bit with ODBC access and support for iterated solution (very useful for balancing projected cashflow where interest-on-short-term-debt & amount-of-short-term-debt depend on each other) and something more akin to pivot tables.

Pity, it could really be a thermonuclear option, instead they just add useless stuff like collaboration features and smart annotations....

I’ve never really used Keynote because that simply isn’t in my line of work.

I really think Apple has a winner on their hands and are handicapping it deliberately either out of neglect or because they didn’t want to scare Microsoft off back in the day and have some kind of gentleman’s agreement going...


Pretty much any time there’s a viable alternative to a Microsoft product, I find the alternative to be a breath of fresh air. There’s something about Windows software in general that makes me feel like I’m in a prison camp relative to good macOS applications.

OmniGraffle vs Visio. Keynote vs PowerPoint. Numbers vs Excel.


I know precisely what you’re referring to. I used to call it the “Cocoa Smell” when I’d come across an application designed for OS X’s native APIs and not some port of something more or less haphazard.

I suppose now they’re more varied (SwiftUI or whatever the technology of the day may be), but there’s a distinct “this is native” vibe from certain alternative applications that doesn’t emanate from others.


Your comment boils down to "whenever there's a better alternative, I like the better alternative better."

Then again, Google Apps is a viable alternative to MS Office, and fresh air it is not.


Doesn't Excel have a similar table system?


As a non-retina display user, LibreOffice works fine, and it is multiple gigabytes smaller than even a single Microsoft Office application.

What are you using word processing for? Of all the todo list apps I've tried or bought, Emacs' org-mode is my favorite.


Mainly I use it when people send me documents to proof/ comment on.

Learning org mode is on my todo list. (Ironic?)


I found it more tolerable running it at 50% resolution.

Still horrible though.


I've had good experiences with OnlyOffice on macOS.


We have an old iMac running 10.11. I use an old version of Numbers on it, and it regularly prompts me to say there is a new version of Numbers available. If I search for Numbers in the App Store, it says it requires 10.13 or higher. ¯\_(ツ)_/¯


Lucky guy, 10.11 is the last to decently display PDFs. I am still on 10.11 only because of that (I am an academic, reading and writing papers).


I'm unaware, what is the issue with later versions?


The issue is that subpixel antialiasing is removed, which affects both retina displays and, more heavily, the non-retina display.

In 10.12, Apple reimplemented its PDF renderer. With that, the subpixel antialiasing was removed. This affects all apps that use it (Preview, Safari, Quicklook, etc.).

In 10.14, Apple turned of subpixel antialiasing in the rest of the operating system (dialogs, buttons, etc.). However, this can be re-enabled by running:

  defaults write -g CGFontRenderingFontSmoothingDisabled -bool NO
In 10.15 and 11.0, subpixel antialiasing is completely gone, and can't be re-enabled.

And there isn't a way to use the 10.11's PDF renderer in 10.12 onwards. However, at least a little bit of luck (until 10.13, maybe 10.14): with above setting you find subpixel antialiasing in some a third party PDF apps that were compiled using the 10.11 frameworks, like PDFpen 9 or PDF Expert 2.4.15.


Likewise. On 10.14 here - what are the issues?


I suspect GP was referring to anti-aliasing for low-res displays, but I’m not sure. I’ve certainly heard that complaint about Preview specifically.

https://www.howtogeek.com/358596/how-to-fix-blurry-fonts-on-...


I wonder if you tried to download it though if it would give you the latest version for your os.


If I click "Update", I get a spinner in the upper left of the App Store window, but nothing appears to happen otherwise.


Libre Office, or just see how you get on with Pages, Numbers, Keynote. I like them


My only problem with Pages is that I can’t figure out how to replace the text in templates without obliterating it completely. Otherwise it’s a good Word replacement.


Pages is not a suitable Word replacement at all!

Send a Word attachment to _anyone_ to collaborate. They can open, read and edit the file (cross platform: Windows, Mac, Linux, Android, iOS)

Send a pages attachment. Receiving party won't know what it is and won't be able to open or read it let alone edit it.


If only there was an 'Export as Word' function. There is! and it works fine for documents that aren't too fancy schmancy in terms of formatting.


> Send a Word attachment to _anyone_ to collaborate. They can open, read and edit the file

If they hate themselves. Because no other app renders Word documents quite correctly, you end up with pagination problems, missing fonts, etc. PDF would be a better choice, or Rich Text if they have to edit it. I pretty much refuse Word documents because of how awful they are to work with if you're not running Word on Windows.


Pages is available on iCloud.com. The web version seems pretty close to parity with the native applications.


Can you use that if you are offline, or otherwise have no contact with the Apple ecosystem?


If you’re running 10.12 you are missing enough other security improvements that this is unlikely to be the greatest risk.


Is is not possible to update the OS? isnt 10.12 quite old?


Does Office.com supports Macro? Seems like it does, but wouldnt it be immune to these attack?


The web version doesn't support macros.


Thanks for the heads up. Would using LibreOffice be safer?


Yes, in the same sense that browsing the web with lynx is safer because there's no javascript to exploit. Some people even consider the lack of javascript to be a feature. If you're just opening documents for viewing/basic editing, you probably won't mind macros being missing. The bigger problem might be the inconsistent layout (and other compatibility issues) that you get.


LibreOffice fully supports a lot of macro features, so I'm not sure what you're refering to about "macros being missing".


LO supports some macros.

Also, I use Lynx/Links+ (and a upgraded Netsurf) because of those JS pests.

So far I can:

- Use pleroma (Mastodon) from https://brutaldon.online. Much faster than any JS bloated platform. Images are viewed externally from sxiv, nothing is lost.

- Search YT from Idiotbox and playing the video with mpv + youtube-dl.

- Read Medium/Tedium general news articles without bogging my CPU down. Links -g supports images.

- Comment here.

- For Reddit I use either TUIR or Gopher.

- I can avoid all malicious cookies too by setting a different config file for links and tunneling it thru torsocks.

For DOCX/XLSX files, you can use antiword/wv and convert the DOC/X file to RTF and then open it under Ted (a really lightweight WP), and sc-im plus gnuplot for spreadsheets. Much faster and secure.

On potentially malicious PDF's and PostScripts, convert them into DJVU and use DJView to read them.


Yes, but... as an author, I’m stuck using Word for working with editors and publishers. (I prefer to use Scrivener.) Using any other application is a bad idea due to incompatibilities. This isn’t theoretical. Change tracking is critical and the “mostly correct” support in other applications is not an acceptable compromise.


Do you use any wysiwyg features of word, or is it literally notepad+git with a UX/UI that people are familiar with? What's unusual about authoring, editing, and publishing such that Word is better than the alternatives? I can't imagine that publishers use Word beyond "ok thanks now I'll arduously convert it into the real format".

FWIW, I (as a programmer) would immediately disqualify any job candidate (except interns) who didn't understand why change tracking was important and know how to use one or more implementations of it. I imagine nearly all of the programmers on HN feel similarly. Explaining that change tracking is critical isn't an unusual claim.


From context, I don't think "change tracking" here is being used as a general category of programmers' revision control systems. When you're working with editors at publishing companies or magazines, you need document revision tracking. Embedded comments, being able to see changes the editor made and being able to accept, reject, or modify them. And your program needs to be able to do this in a way that makes round-tripping the document between you and the editor absolutely bullet-proof. If the editor is using Word (and they are), that means you either need Word yourself, or you need something that's so good at doing that round-tripping with Word that the editor doesn't notice you're using something else.

And, speaking as someone who really doesn't like using Word and has searched for various solutions, this turns out to be really hard. I haven't looked at LibreOffice in the last two or three years, I confess, so it may have solved this by now -- but neither it nor OpenOffice could consistently manage this. There are other word processors that don't even try. I eventually settled on using Apple Pages, which so far seems to manage this well enough that no editor has called me on it.

I can see people raising their hands to object to my assertion that the editor is using Word, because they submitted to a mathematical or engineering journal that accepts submissions in LaTeX. And, sure, there are meaningful exceptions out there, but I can assure you that if you peruse the submission requirements for virtually any non-technical publisher, they are going to either mention Word or just expect Word because it's the industry standard for manuscripts. It doesn't matter how much better any other system is -- Penguin Random House ain't gonna change their workflow to accommodate you.


I believe kayodelycaon is saying change tracking IS critical - specifically Word's implementation of it (aka "Track Changes"). Many authoring workflows I've witnessed heavily rely on all parties being able to see the changes made in a Word document.


Change tracking is a second class citizen in Word.

My question is, if change tracking is so important, why use Word instead of any of the dozens of workflows where change tracking is a first class citizen? I used git as an example in my post; git takes change tracking seriously, (it does _literally_ nothing else) Word does not. Why prefer Word when change tracking matters? The argument of "Change tracking is priority #1 so I choose Word" sounds a lot like "Gas mileage is priority #1 so I choose the Dodge RAM with like the biggest engine ever" to me. If change tracking is priority #1, why not... buy a Honda Fit?


> My question is, if change tracking is so important, why use Word instead of any of the dozens of workflows where change tracking is a first class citizen?

The simple answer is, and always will be, that it is what your editor uses.

I would prefer to use LaTeX for most of my published works. It allows me to be more precise in layouts, and do things that are just downright convoluted in Word.

But if the editor uses Word, then you don't have a choice. You're not changing the publishing house.


I've seen what a self-published author who is proficient LaTeX can do. The physical book is absolutely beautiful. I don't think Word could replicate it and only a pdf could capture it on a digital device. Your basic Kindle ebook is a bit more limited.


In a perfect world, you would be right. But people in publishing houses are really not technology-savvy, most of them can barely use Word. They’ve been using it for 20 years and they will not use something different. I once worked for a magazine where they did not even use Words change tracking, you had to write the changes into the text with a different color, and they didn’t want to hear that this was a stupid workflow.


Git is a generalized change tracking system. A domain-specific system might easily do better. (I've used Word's change tracking a little and it seems fine, with domain-specific features.)


Word's Track Changes and git are entirely different tools for entirely different purposes.

Track Changes is equivalent to the github pull request workflow. It's not meant to be a permanent record. If you want a permanent record, store a copy of the file somewhere. The lazy versioning method is to use your email. If you need an old version, search for it. :D


Because the task at hand is "interoperate with dozens of other people whom you don't control and who are all using Microsoft Word Track Changes feature". In that (extremely limited but important) sense, Track Changes is first class citizen and git and all other systems that aren't exactly that are second-class.


Because got does nothing else, not even provide a UI for WYSIWYG editing a doc.

If you have a great idea for a GitHub for Books, do it! You'll make a fortune from publishers


WYSIWYG is not relevant here. The structured document format, very much is. Chapters, footnotes, references, quotations, tables, etc. It's more like Org mode + TeX + git.


I guess I'm misunderstanding then. Word's core feature is wysiwyg. Word as a document format is necessarily unstructured - "hey I'm gonna increase the font size of this text over here by like 12 or 14 pts or whatever and switch it to center identation and write 'Chapter 3'" -- that's the 'killer feature' of Word that defines it. Structural stuff like the idea of chapters or version keeping are all secondary to the defining wysiwyg feature.

If the goal is structure+change tracking, it seems like switching from an unstructured document format to a format/combination of formats that provides structure+change tracking is an easy slam dunk. Structure and interoperability with version control systems are both first class features of latex. Structure and version control are secondary features of Word. ...Why?


One of the great epiphanies of engineering is that my "the" definining feature is not your "the" defining feature. Also that there is actually considerable depth to applications and industries outside one's own.


Word supports semantic structuring as well, and one can even disable direct styles manipulation.

As for why, industry standards.


How can you disable direct styles manipulation? I’ve looked for that feature and never found it (although in response I just gave up on Wod as a serious tool for anything beyond short letters)


Say more about what you can't seem to find here. The idea that Word is not a serious tool, or is not suitable for anything longer than a letter, is just laughably false given how widely used it is in pursuits orders of magnitude more complex than a letter to your Aunt Millie.

I'm being a LITTLE snarky, but I also am genuinely offering to help, if you want it.


Not the parent poster, but I believe he asked how you can disable direct (ad-hoc) styles manipulation? That's something I'm also interested in - my ideal Word document would be the one in which I define styles to be used and every paragraph uses exactly one of these styles and the user can't say "I'll make these few words 14pt just because".



I believe another replier has noted how one may do that.


IIRC Word used to have an "outline editing" mode where normal visual styles were largely ignored and replaced with a uniform set of rendering styles. Its principal feature was the ability to fold nested structures (chapters, sections, etc) and easily reorder them.


It still does. The macOS version has it in the menu bar: View > Outline.


And if you disable it, some helpful co-worker will helpfully re-enable it and add a bunch of red text as "comments".


It sounds like you're not familiar with what Word's traditional strength over other word processors was, even back in the DOS version days: support for semantically meaningful structured documents + stylesheets to attach to those structures.

It's a big deal. I live in emacs for most of my writing and notetaking, but I love using Word to create structured documents for clients (e.g., implementation guidelines, etc) because it's easy and works very very well, and I don't have a weird toolchain on the back end of the process to produce something they can easily consume.

The tl;dr here is that it is incorrect to say that Word is a WYSIWYG editor only necessarily and only capable of unstructured work. Sure, lots of people only ever use it that way, but it has strong support for document structure and intelligent styling (to say nothing of internal change tracking), and this is what makes it a good (and popular!) choice for large-scale document work.


Indeed - a co-worker long ago introduced me to the power of references and if you deal with contracts or legal documents that reference other parts of a document nothing else comes close!


For the record, I am publishing stories, not writing code. To work with publishers, I need to use their format. That format is Microsoft Word. Specifically, the Windows or macOS versions of Word, _not_ the online or iOS versions. The only workable alternative I know of is Pages on macOS.

Word's Track Changes feature is used to show where an Editor or Author wants to make changes, ask questions, or make comments. If you do not use Word, you risk comments or changes going silently missing. Worst case, complete, irreversible corruption of the document. This is not theoretical, publishers have horror stories about authors using Libre/Open Office or incompatible versions of Word.

Word is very much the "real format" for most of the process. You may be thinking of typesetting, which uses different file formats depending on which application is used. As an author, I don't see that part of the process.


I mean, probably, but you'll also go nuts trying to any serious collaboration with true-Office people.


This attack only works if the user clicks 'enable macros' when the document is opened or when the "“Disable all macros without notification" setting is enabled (ironic) or if you are using Office 2011.

TL;DR: Looks like most of the exploits have been patched, and even still, if they hadn't been patched you probably would have been fine using later versions of office (at least in the context of the attacks outlined) if you don't open and run documents with macros and you don't have that setting enabled.


No it features a different exploit involving an ancient programming language in an ancient file format that they forgot when they added the notifications.


Opens website

Gets instant popup covering the content asking me to sign up

Closes website


For real though, does ANYONE instantly sign up on the first visit to a website?

Why does anyone continue to think this is a good idea?

I immediately closed the article as well.


If you are using uBlock Origin or similar you can enable 'Annoyances' filter lists (off by default) that take care of many overlays, cookie popups, etc.


Even better, you can just leave websites that do this. I have no interest in helping anyone beef up their numbers by hanging around longer if they're going to be outright hostile to their readers/users like this.


My browser doesn't run javascript by default, and the website is not an webapp, so it appear to be fine


Would you run a web app?

Checking my strategy to avoid Apple's app store.


The meaning there was that the web page is a web page with content pre-installed and everything, as opposed to an enormous but content-free javascript container that then does a lot of unnecessary work on your machine to fetch the content, piece by piece, and assemble and render the content that should have been assembled at the server before sending it to you.


It's quite unreadable on mobile too, unfortunately. I'm not sure you're not missing out.


I'm a little bit nervously skeptical of a security website that gives me a browser prompt about accessing Virtual Reality devices




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: