3 ms·

What AVs use this? I keep hearing horrible things about AVs but little proof. I know Tavis from Google finds bugs and AV in rare cases can reduce security, but

What AVs use this? I keep hearing horrible things about AVs but little proof. I know Tavis from Google finds bugs and AV in rare cases can reduce security, but that's a far cry from them embedding FOSS projects to save time. For AV companies writing a rar parser is a single-day activity, its hard to believe they need this app. The few places I've seen 7z used is in installers where the input is known (installer archive in 7z format) and I'm assuming signed in many cases so you can't feed it random inputs. I find it hard to believe Sophos and Symantec and Trend are copying and pasting 7zip.dll into their apps.

pfg 8y ago
I don't know about 7-Zip specifically, but AV vendors use plenty of FOSS code. Here's some findings just from Google's P0 showing that Symantec[1], Bitdefender[2], Microsoft[3] and Avast[4] all use unrar in their products. It wouldn't be far-fetched to assume some might use 7-Zip for other archive formats. [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=810 https://bugs.chromium.org/p/project-zero/issues/detail?id=81... [2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1278 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1543 https://bugs.chromium.org/p/project-zero/issues/detail?id=15... [4]: https://bugs.chromium.org/p/project-zero/issues/detail?id=575 https://bugs.chromium.org/p/project-zero/issues/detail?id=57...
uep 8y ago
Maybe I'm just way overestimating how complex RAR archives are (I admit, I have not looked into this), but I think you're out of your mind if you think that someone could write a parser to analyze RAR archives in a day. That it would be better tested, debugged, and more secure than a tool that has probably seen more widespread use than any single AV.

pfg 8y ago

I don't know about 7-Zip specifically, but AV vendors use plenty of FOSS code. Here's some findings just from Google's P0 showing that Symantec[1], Bitdefender[2], Microsoft[3] and Avast[4] all use unrar in their products. It wouldn't be far-fetched to assume some might use 7-Zip for other archive formats. [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=810 https://bugs.chromium.org/p/project-zero/issues/detail?id=81... [2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1278 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... [3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1543 https://bugs.chromium.org/p/project-zero/issues/detail?id=15... [4]: https://bugs.chromium.org/p/project-zero/issues/detail?id=575 https://bugs.chromium.org/p/project-zero/issues/detail?id=57...

uep 8y ago

Maybe I'm just way overestimating how complex RAR archives are (I admit, I have not looked into this), but I think you're out of your mind if you think that someone could write a parser to analyze RAR archives in a day. That it would be better tested, debugged, and more secure than a tool that has probably seen more widespread use than any single AV.