Top all-time · #3572
0patch
Company blog · blog.0patch.com/blogsecurity
0patch is the company blog at blog.0patch.com, writing about security. Since 2018, 22 different Hacker News readers have linked it 23 times, most often “Did Microsoft Just Manually Patch Their Equation Editor Executable? (2017)”. It is still writing: the last post was on 2026-10-21, and you can follow it by feed.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN readers cite 0patch's posts on micropatching old Windows software, such as the 2017 binary patch of the Equation Editor, and on extended security support for Windows 7, 10 and XP. The comments link these posts as sources rather than judging them.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Tiny reboot-less security patches for critical vulnerabilities in Windows, Microsoft Office, and other Windows products
Most-linked posts?
- Did Microsoft Just Manually Patch Their Equation Editor Executable? (2017)7 people · 7 mentions · first linked 2018-08-31
- End of Windows 10 Support Looming? Don't Worry, 0patch Will Keep You Secure3 people · 3 mentions · first linked 2024-07-01
What Hacker News says?
https://blog.0patch.com/2017/11/did-microsoft-just-manually-...
Comment linking /2017/11/did-microsoft-just-manually-patch-their.html
on “Outdated vs. Complete: In defense of apps that don’t need updates”Submitted 0patch Blog: No Source Code for a 14-Year Old Vulnerable DLL? No Problem as a story · 54 points
HN discussion> I used the zoom native client and not the web one You might want to reconsider that; they have a pretty bad security track record: https://www.securemac.com/news/zoom-security-flaw-puts-you-a... https://talosintelligence.com/vulnerability_reports/TALOS-20... https://talosintelligence.com/vulnerability_reports/TALOS-20... https://blog.0patch.com/2020/07/remote-code-execution-vulner...
Comment linking /2020/07/remote-code-execution-vulnerability-in.html
on “A Modern JavaScript Tutorial”Submitted Micropatching “Ms-Officecmd” Remote Code Execution (No CVE) as a story · 3 points
HN discussionCVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns. I remember some Windows Fax Service related CVEs and some Wi-Fi drivers that couldn't be fixed directly, too, but don't remember the CVE or whether that was related to the Broadcom driver/module sideloading fuckup. > The link you ga…
Comment linking /2017/11/did-microsoft-just-manually-patch-their.html
on “A Brazilian CA trusted only by Microsoft has issued a certificate for google.com”Submitted URL File NTLM Hash Disclosure Vulnerability (0day) as a story · 2 points
HN discussion1472 patched here too https://blog.0patch.com/ https://0patch.com/ Great for old systems where updating breaks stuff
Comment linking /
on “Windows Server vulnerability requires immediate attention”Submitted End of Windows 10 Support Looming? Don't Worry, 0patch Will Keep You Secure as a story · 2 points
HN discussionSo the specific story I was referring to was an obscure security fix to their equation editor in binary, rather than source. The impressive bit wasn't just editing a binary but patching a bunch of security holes without altering any other instructions: https://blog.0patch.com/2017/11/did-microsoft-just-manually-... That said, I'll bet this kind of 10x programming is genuinely rarer these days. Not because programmer…
Comment linking /2017/11/did-microsoft-just-manually-patch-their.html
on “I was a 10x engineer and I’m sorry”Submitted Did Microsoft Just Manually Patch Their Equation Editor Executable? (2017) as a story · 2 points
HN discussionI seem to remember Microsoft in the past also manually patched the binary for it because they probably lost the source code to it. [1] [1] https://blog.0patch.com/2017/11/did-microsoft-just-manually-...
Comment linking /2017/11/did-microsoft-just-manually-patch-their.html
on “What’s the jankiest piece of tech you’ve seen a company depend on?”Submitted Microsoft Edge Uses a Secret Trick and Breaks Internet Explorer's Security as a story · 2 points
HN discussionYou could also get 0patch to keep it secure. They're adopting Windows 10 for security updated from the EOL date. Pretty reasonable price as well, around 30 euros per year. https://blog.0patch.com/2024/06/long-live-windows-10-with-0p...
Comment linking /2024/06/long-live-windows-10-with-0patch.html
on “Windows 10 begins one-year countdown to end of support”Submitted The MSRD3X40 patch debacle as a story · 2 points
HN discussion> Remember that in some cases people don't have the source code for programs, or the tools that could build it. Microsoft preserves that. And even if they failed to preserve the source code or the toolchain for whatever reason, they go to extreme lengths to get fixes in: https://blog.0patch.com/2017/11/did-microsoft-just-manually-...
Comment linking /2017/11/did-microsoft-just-manually-patch-their.html
on “The early history of Windows file attributes”Submitted Micropatching Brings the Abandoned Equation Editor Back to Life (2018) as a story · 1 points
HN discussionSeems like there's a company offering those patches to individuals: https://blog.0patch.com/2019/09/keeping-windows-7-and-window... As a Windows 7 user myself (on a personal computer) for whom upgrading seems clearly net negative, I'm tempted. Has anyone here used their stuff?
Comment linking /2019/09/keeping-windows-7-and-windows-server.html
on “Microsoft Offers Windows 7 Extended Update Support to SMBs”Submitted Analyzing and Micropatching with Tetrane Reven (Part 1, CVE-2021-26897) as a story · 1 points
HN discussionWindows Embedded POSReady 7 Extended Security Update Year 3 - End Date 2024-10-08 https://learn.microsoft.com/en-us/lifecycle/products/windows... and you also have 0patch https://blog.0patch.com/2022/10/two-more-years-of-critical-s...
Comment linking /2022/10/two-more-years-of-critical-security.html
on “Fix Windows Update on Windows XP, Vista, Server 2008, 2003, and 2000”Submitted Our First Weeks of Securing Windows 7 and Windows Server 2008 R2 as a story · 1 points
HN discussionThere will be paid security updates from Microsoft [0], 0patch [1] (if you trust them), the LTSC version (which however takes you back to 21H2), and lastly you can still take your chances with just Windows Defender signature updates. I know a couple of people who still run Windows 7, including a security researcher (and not for research purposes), which still receives Microsoft Defender signature updates. [0] https:…
Comment linking /2024/06/long-live-windows-10-with-0patch.html
on “With 10 months of support remaining, Windows 10 still dominates”Submitted One Two Three Micropatches for Three Windows 0days as a story · 1 points
HN discussionIf you look at the first binary patch for Equation Editor, it's very well done: https://blog.0patch.com/2017/11/did-microsoft-just-manually-... . The problem was that when they fixed it once, other researchers started fuzzing Equation Editor and found many more bugs. Bringing a C++ program from 2000 up to modern security standards when you don't have the source code isn't really feasible, it would be an endless seri…
Comment linking /2017/11/did-microsoft-just-manually-patch-their.html
on “Micropatching Brings the Abandoned Equation Editor Back to Life (2018)”
