9 ms·

Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe languag

Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.html https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming job, provided that we approach the task with a full appreciation of its tremendous difficulty, provided that we stick to modest and elegant programming languages, provided that we respect the intrinsic limitations of the human mind and approach the task as Very Humble Programmers.

withinrafael 9y ago
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
- leeter 9y ago
  Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.
  - rootw0rm 9y ago
    Agreed.
  - askvictor 9y ago
    It's open source; feel free to fork.
    - exikyut 9y ago
      "Secure 7-Zip" even sounds like a good name.
    - leeter 9y ago
      sigh already downloaded the source, trying to convince myself I need to do this. The code is pretty much pure C++98 along with all the pain that comes with that.
- chrisper 9y ago
  Is there a good alternative to 7-zip?
  - skrowl 9y ago
    PeaZip is pretty good and is FOSS
    - mmozeiko 9y ago
      > PeaZip is free file archiver utility, based on Open Source technologies of 7-Zip, p7zip, FreeArc, PAQ, and PEA projects. It seems to use 7-Zip and/or p7zip binaries.
      - skrowl 9y ago
        p7zip was also patched. 18.00 doesn't have the bug, but it looks like Peazip hasn't been updated with it. I'm not sure what other FOSS alternative to use. BandiZip is free (as in beer) but doesn't seem to have an update since Sept, so if it uses p7zip under the hood for 7z, it's also vulnerable.
  - Hello71 9y ago
    for just decompression, unarchiver has free software implementation of unrar. for compression, use command line (tar -J, zip, whatever) or file roller.
  - nbsd4lyfe 9y ago
    Libarchive (sometimes known as bsdtar) supports 7z with an independent implementation.
    - pmorici 9y ago
      I think he means an open source unarchiver that works on windows. Obviously Linux and bad have tar/gz/bz2 etc
      - deleted 9y ago
- vocatus_gate 9y ago
  Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.
  - Ajedi32 9y ago
    Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.
    - dogma1138 9y ago
      Since they get theirs from an insecure source it really isnt.
    - icebraining 9y ago
      No, you can get them from the official Sourceforge project over HTTPS: https://sourceforge.net/projects/sevenzip/ https://sourceforge.net/projects/sevenzip/
- AnIdiotOnTheNet 9y ago
  Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is because it is lightweight no-bullshit software that does its job and otherwise stays out of the way. We could stand to do with some more of that in 2018.
  - yzmtf2008 9y ago
    Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that. These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.
    - quickben 9y ago
      So, how is HTTPS related to the binary size? Arguably, you both bullshited, but his was more on topic.
  - pcwalton 9y ago
    > He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. This attitude is much of the reason why software security is as bad as it is today. I'll take a little "bloat" over ZIP files being able to install ransomware (and security vs. performance doesn't have to be a tradeoff anyway).
  - blub 9y ago
    Using HTTPS for downloads and signing binaries won't magically make software slower. It's the security equivalent of washing one's hands after using the toilet...
userbinator 9y ago
On the other hand, Dijkstra also has this quote which suggests he is not too fond of "mitigation" either: "If you want more effective programmers, you will discover that they should not waste their time debugging, they should not introduce the bugs to start with."
- Klasiaster 9y ago
  Yes, that's why the quote was already suggesting to use better languages, but mainly it's about attitude and being aware that things go wrong, so you should turn on what you can you responsibly decided to stick to C.

withinrafael 9y ago

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

leeter 9y ago
Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.
- rootw0rm 9y ago
  Agreed.
- askvictor 9y ago
  It's open source; feel free to fork.
  - exikyut 9y ago
    "Secure 7-Zip" even sounds like a good name.
  - leeter 9y ago
    sigh already downloaded the source, trying to convince myself I need to do this. The code is pretty much pure C++98 along with all the pain that comes with that.
chrisper 9y ago
Is there a good alternative to 7-zip?
- skrowl 9y ago
  PeaZip is pretty good and is FOSS
  - mmozeiko 9y ago
    > PeaZip is free file archiver utility, based on Open Source technologies of 7-Zip, p7zip, FreeArc, PAQ, and PEA projects. It seems to use 7-Zip and/or p7zip binaries.
    - skrowl 9y ago
      p7zip was also patched. 18.00 doesn't have the bug, but it looks like Peazip hasn't been updated with it. I'm not sure what other FOSS alternative to use. BandiZip is free (as in beer) but doesn't seem to have an update since Sept, so if it uses p7zip under the hood for 7z, it's also vulnerable.
- Hello71 9y ago
  for just decompression, unarchiver has free software implementation of unrar. for compression, use command line (tar -J, zip, whatever) or file roller.
- nbsd4lyfe 9y ago
  Libarchive (sometimes known as bsdtar) supports 7z with an independent implementation.
  - pmorici 9y ago
    I think he means an open source unarchiver that works on windows. Obviously Linux and bad have tar/gz/bz2 etc
    - deleted 9y ago
vocatus_gate 9y ago
Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.
- Ajedi32 9y ago
  Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.
  - dogma1138 9y ago
    Since they get theirs from an insecure source it really isnt.
  - icebraining 9y ago
    No, you can get them from the official Sourceforge project over HTTPS: https://sourceforge.net/projects/sevenzip/ https://sourceforge.net/projects/sevenzip/
AnIdiotOnTheNet 9y ago
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is because it is lightweight no-bullshit software that does its job and otherwise stays out of the way. We could stand to do with some more of that in 2018.
- yzmtf2008 9y ago
  Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that. These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.
  - quickben 9y ago
    So, how is HTTPS related to the binary size? Arguably, you both bullshited, but his was more on topic.
- pcwalton 9y ago
  > He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. This attitude is much of the reason why software security is as bad as it is today. I'll take a little "bloat" over ZIP files being able to install ransomware (and security vs. performance doesn't have to be a tradeoff anyway).
- blub 9y ago
  Using HTTPS for downloads and signing binaries won't magically make software slower. It's the security equivalent of washing one's hands after using the toilet...

userbinator 9y ago

On the other hand, Dijkstra also has this quote which suggests he is not too fond of "mitigation" either: "If you want more effective programmers, you will discover that they should not waste their time debugging, they should not introduce the bugs to start with."

Klasiaster 9y ago
Yes, that's why the quote was already suggesting to use better languages, but mainly it's about attitude and being aware that things go wrong, so you should turn on what you can you responsibly decided to stick to C.