When a Text Editor's Author Jokes About Polluting Your Files

Part 1The Incident Itself

The tweet, and when

On 25 January 2023✓, the official Notepad++ Twitter account @Notepad_plus posted:

A new feature just enabled in Notepad++:

If you don't agree with its politics views, Notepad++ will add random characters in your source code.

@Notepad_plus, Twitter, 2023-01-25

The author's official clarification

On 31 January 2023✓, Don Ho addressed the matter in the Notepad++ v8.4.9 release note:

"It was a joke I made on twitter. The joke might not be funny, but apparently not everyone is smart enough to realize it's just a joke, and Notepad++ on GitHub has been vadalized again."

"A lot of obtuse people exist nowadays because nothing in the food chain eats them anymore, and they become even developpers… :)"

Notepad++ v8.4.9 release note (original spelling preserved: "vadalized", "developpers")

The same page embeds a screenshot of the GitHub vandalism (vandalism.png) alongside Don Ho's full statement✓. Worth noting: he did not delete the original tweet, and did not apologise.

Part 2Who Is Don Ho?

Background

Notepad++'s reach and user base

Don Ho is not an ordinary software author. Notepad++ is one of the most widely used text editors on Windows worldwide:

• In Stack Overflow's 2015 global developer survey, Notepad++ was the most-used text editor in the world, with 34.7% of respondents using it daily (n=26,086) ✓
• The 2016 figure was 35.6% ✓
• Cumulative SourceForge downloads (2003–2010) exceeded 28 million ✓
• Won the SourceForge Community Choice Award for Best Developer Tool twice ✓
• Still actively maintained on GitHub today

Don Ho's long-running pattern of political statements

This is not the first time Don Ho has wrapped a political position around a release. The "random characters" tweet sits in a long line of release notes and version names that carry his political views:

Each political statement was met with retaliation from the opposing side:

• After the 2015 "Je suis Charlie" edition, the Notepad++ website was breached by the Islamist hacking group Fallaga Team ✓
• After 2019's "Free Uyghur", the site was hit by DDoS attacks attributed to Chinese sources, and the GitHub issues tracker was flooded with nationalist comments ✓
• After 2020's "Stand with Hong Kong", the Notepad++ download page was blocked in major Chinese browsers (QQ, UC, 360, Sogou) ✓

This context matters: the "random characters" tweet was an ironic riposte after years of being dogpiled on GitHub by Chinese netizens. But the context only explains the motive — it does not absolve the joke of its underlying problem.

Part 3Reactions in Chinese-language Media

The real reaction to the tweet was concentrated in Chinese-language communities (especially mainland China). Mainstream English-language tech outlets did not run dedicated coverage.

Simplified-Chinese reactions

The dominant register was a call to boycott Notepad++ and switch to alternatives (VSCode, Sublime, CudaText):

What the Chinese-language reactions have in common

1. Headline strategy: most strip out the "joke" framing and write the headline as if the random-character feature were real, leaving the reader's first impression that this is a literal threat.
2. Refusal to accept the "joke" defence: even pieces that mention Don Ho's clarification dismiss it as "unconvincing" or "intentional".
3. Recurring factual errors: many articles label Don Ho as "a software developer from Taiwan, China province" or "a Taiwan-independence figure" — he is, in fact, French.
4. Boycott-and-replace bundle: the coverage is paired with alternatives lists (VSCode, Sublime Text, CudaText, Notepad--), forming a complete "switching guide" content package.

English-language press: almost no dedicated coverage

Mainstream English-language tech outlets (The Verge, Ars Technica, TechCrunch, The Register) did not run dedicated stories on this tweet. Hacker News and Reddit did not produce sustained discussion threads either. The most thorough English-language piece on Don Ho's pattern of political statements is XDA Developers' long read, "Notepad++ and Don Ho: A story of software, activism, and defiance" — but it does not specifically address the "random characters" tweet.

Part 4Why This Joke Cannot Be Made — A Technical Argument

Chinese-language criticism mostly stayed at the level of political alignment; the English-language reaction largely treated it as more of Don Ho's familiar irony. The thing both sides missed is the actual problem:

A text editor's author publicly threatening to "add characters to your files", joke or otherwise, crosses a professional-ethics line. They are using their technical position over their users — the asymmetric power they hold by virtue of being the editor's author — as the punchline.

Breaking the trust boundary

A text editor handles its user's work product. Inside that trust relationship, the user assumes the editor will faithfully save what they typed and not modify the file on its own. That assumption belongs to the same family of professional trust as a chef not tampering with a customer's food, a surgeon not freelancing during anaesthesia, a lawyer not leaking a client's evidence to the opposing party.

Joking that "I will pollute your output based on your political position" is equivalent to placing yourself in the position of "I have both the capability and the willingness to break this trust" — and that statement, joke or not, will live on permanently in the public record.

What "inserting random characters" actually means in practice

To readers unfamiliar with software development, "a few random characters" sounds trivial. It is not. Silent character insertion is an attack class with very serious consequences. A few specific examples:

rm -rf /home/user/public_html/test

rm -rf / home/user/public_html/test

rm -rf "$STEAMROOT/"*

rm -rf "/"*

Why Don Ho, in particular, should know this

Don Ho is not a casual user. According to his own CV, he has spent years working in security-adjacent companies:

• Dictao — banking-grade security solutions (cryptography, PKCS#11, smart cards) ✓
• Oberthur Card Systems — smart-card security (HSM, encryption) ✓
• Dashlane — password manager (OpenSSL, encryption) ✓

As a developer with a security background, who has been writing a text editor for two decades, he knows better than most:

• Unicode zero-width characters, homoglyph attacks, shell injection — these are real, named attack classes.
• The full spectrum of consequences of "inserting characters into a user's file" is well understood.
• This is not "naïvely joking about something impossible" — he is using a technically feasible, very-high-impact attack class as a punchline.

The problem of the joke is independent of which side it took

If you flip the political polarity — imagine an open-source editor whose author tweets:

"For users who disagree with my support for the Chinese government, this editor will add random characters to your code."

The problem is identical. It is not about whose politics are correct. It is about this:

A text editor's author should not use "harm to users' files" as a threat-shaped punchline.

Same logic as: a lawyer cannot joke about leaking your evidence to the opposing party; a surgeon cannot joke about freelancing during anaesthesia. The structure of professional trust determines which jokes are available and which are not.

The critics on the other side missed the same point

Most Chinese-language critics circled around "wrong politics", treating this as a continuation of Don Ho's "anti-China" speech series. Their reaction also carries a positional filter — they are angry because the politics ran the other way, not because they noticed what was actually unprofessional about the joke.

In other words, the joke exposed a problem that neither side fully recognised: a public statement by an open-source author is, simultaneously, a security statement. When the author publicly hints at willingness to do something harmful, user trust will (and should) drop, regardless of intent. This is a question of professional ethics, not of political alignment.

Part 5Aftermath and Current Status

• Don Ho's response in the v8.4.9 release note remains his only official statement. He did not delete the original tweet, and he did not apologise — he simply asserted "it was a joke" and mocked the people who didn't get it as "obtuse".
• Notepad++'s download numbers and user base did not visibly drop. Plenty of users continued using it after the incident.
• The Chinese-language "switch to an alternative" content continues to circulate, but with limited effect: many users came back to Notepad++ once the muscle-memory friction kicked in.
• In March 2025, an unofficial Notepad++ for Mac (ported by Andrey Letov) was released, expanding the user base further ✓.
• In 2025, state-sponsored hackers — suspected to be the Chinese APT31 group — hijacked Notepad++'s update functionality by compromising its hosting provider, distributing malware to East-Asian targets ✓. This is a separate security incident, unrelated to the 2023 tweet, but it illustrates that Notepad++ has long been a target of nation-state-grade threat actors.

Closing

The value of this incident is not that it became some great scandal — it didn't. It made noise in Chinese-language communities and barely a ripple in English ones. But it is worth dissecting carefully, because it cleanly illustrates three things that people frequently conflate:

1. The author's personal speech rights vs. the author's professional position as software maintainer — the former is unproblematic; the latter carries an obligation to weigh the "security-statement" effect of public utterances.
2. The political tug-of-war vs. the line of professional ethics — most critics stayed on the first, which kept the second invisible.
3. The "it was just a joke" defence vs. the irreversibility of public-platform speech — a tweet that has been published lives on in search engines and snapshots; the "joke" label cannot retroactively undo the loss of trust it caused.

For open-source communities, software developers, and anyone thinking about software ethics, Don Ho's tweet is worth keeping as a negative-example case study — not because of his politics, but because, for a moment, he used the technical power he holds over millions of users as a punchline.

Sources

Primary sources

Reference works

Chinese-language reactions

English-language coverage

Steam rm -rf case (technical argument)