5 ms·

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

leeter 9y ago
Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.
- rootw0rm 9y ago
  Agreed.
- askvictor 9y ago
  It's open source; feel free to fork.
  - exikyut 9y ago
    "Secure 7-Zip" even sounds like a good name.
  - leeter 9y ago
    sigh already downloaded the source, trying to convince myself I need to do this. The code is pretty much pure C++98 along with all the pain that comes with that.
chrisper 9y ago
Is there a good alternative to 7-zip?
- skrowl 9y ago
  PeaZip is pretty good and is FOSS
  - mmozeiko 9y ago
    > PeaZip is free file archiver utility, based on Open Source technologies of 7-Zip, p7zip, FreeArc, PAQ, and PEA projects. It seems to use 7-Zip and/or p7zip binaries.
    - skrowl 9y ago
      p7zip was also patched. 18.00 doesn't have the bug, but it looks like Peazip hasn't been updated with it. I'm not sure what other FOSS alternative to use. BandiZip is free (as in beer) but doesn't seem to have an update since Sept, so if it uses p7zip under the hood for 7z, it's also vulnerable.
- Hello71 9y ago
  for just decompression, unarchiver has free software implementation of unrar. for compression, use command line (tar -J, zip, whatever) or file roller.
- nbsd4lyfe 9y ago
  Libarchive (sometimes known as bsdtar) supports 7z with an independent implementation.
  - pmorici 9y ago
    I think he means an open source unarchiver that works on windows. Obviously Linux and bad have tar/gz/bz2 etc
    - deleted 9y ago
      [deleted]
- askvictor 9y ago
  What are your criteria? I moved to Bandizip a few months back and it covers all of my requirements quite well.
- rurban 9y ago
  I also lost my trust into zlib recently, given that the current released version is full of bugs, and the current master is written horribly. Not as bad as openssl, but close. E.g. they are still using K&R sigs, wrong casts, and have several copy&paste bugs which you only detect with a stricter c++ compiler.
vocatus_gate 9y ago
Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.
- Ajedi32 9y ago
  Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.
  - dogma1138 9y ago
    Since they get theirs from an insecure source it really isnt.
  - icebraining 9y ago
    No, you can get them from the official Sourceforge project over HTTPS: https://sourceforge.net/projects/sevenzip/ https://sourceforge.net/projects/sevenzip/
AnIdiotOnTheNet 9y ago
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is because it is lightweight no-bullshit software that does its job and otherwise stays out of the way. We could stand to do with some more of that in 2018.
- yzmtf2008 9y ago
  Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that. These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.
  - quickben 9y ago
    So, how is HTTPS related to the binary size? Arguably, you both bullshited, but his was more on topic.
- pcwalton 9y ago
  > He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. This attitude is much of the reason why software security is as bad as it is today. I'll take a little "bloat" over ZIP files being able to install ransomware (and security vs. performance doesn't have to be a tradeoff anyway).
- blub 9y ago
  Using HTTPS for downloads and signing binaries won't magically make software slower. It's the security equivalent of washing one's hands after using the toilet...

leeter 9y ago

Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.

rootw0rm 9y ago
Agreed.
askvictor 9y ago
It's open source; feel free to fork.
- exikyut 9y ago
  "Secure 7-Zip" even sounds like a good name.
- leeter 9y ago
  sigh already downloaded the source, trying to convince myself I need to do this. The code is pretty much pure C++98 along with all the pain that comes with that.

chrisper 9y ago

Is there a good alternative to 7-zip?

skrowl 9y ago
PeaZip is pretty good and is FOSS
- mmozeiko 9y ago
  > PeaZip is free file archiver utility, based on Open Source technologies of 7-Zip, p7zip, FreeArc, PAQ, and PEA projects. It seems to use 7-Zip and/or p7zip binaries.
  - skrowl 9y ago
    p7zip was also patched. 18.00 doesn't have the bug, but it looks like Peazip hasn't been updated with it. I'm not sure what other FOSS alternative to use. BandiZip is free (as in beer) but doesn't seem to have an update since Sept, so if it uses p7zip under the hood for 7z, it's also vulnerable.
Hello71 9y ago
for just decompression, unarchiver has free software implementation of unrar. for compression, use command line (tar -J, zip, whatever) or file roller.
nbsd4lyfe 9y ago
Libarchive (sometimes known as bsdtar) supports 7z with an independent implementation.
- pmorici 9y ago
  I think he means an open source unarchiver that works on windows. Obviously Linux and bad have tar/gz/bz2 etc
  - deleted 9y ago
    [deleted]
askvictor 9y ago
What are your criteria? I moved to Bandizip a few months back and it covers all of my requirements quite well.
rurban 9y ago
I also lost my trust into zlib recently, given that the current released version is full of bugs, and the current master is written horribly. Not as bad as openssl, but close. E.g. they are still using K&R sigs, wrong casts, and have several copy&paste bugs which you only detect with a stricter c++ compiler.

vocatus_gate 9y ago

Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.

Ajedi32 9y ago
Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.
- dogma1138 9y ago
  Since they get theirs from an insecure source it really isnt.
- icebraining 9y ago
  No, you can get them from the official Sourceforge project over HTTPS: https://sourceforge.net/projects/sevenzip/ https://sourceforge.net/projects/sevenzip/

AnIdiotOnTheNet 9y ago

Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is because it is lightweight no-bullshit software that does its job and otherwise stays out of the way. We could stand to do with some more of that in 2018.

yzmtf2008 9y ago
Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that. These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.
- quickben 9y ago
  So, how is HTTPS related to the binary size? Arguably, you both bullshited, but his was more on topic.
pcwalton 9y ago
> He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. This attitude is much of the reason why software security is as bad as it is today. I'll take a little "bloat" over ZIP files being able to install ransomware (and security vs. performance doesn't have to be a tradeoff anyway).
blub 9y ago
Using HTTPS for downloads and signing binaries won't magically make software slower. It's the security equivalent of washing one's hands after using the toilet...