6 ms·

>The good news is, if you use a third-party app for archives, such as WinZip, WinRAR or 7-Zip, you won't encounter the bug. I'm not excusing the bug, but 7-zip

>The good news is, if you use a third-party app for archives, such as WinZip, WinRAR or 7-Zip, you won't encounter the bug. I'm not excusing the bug, but 7-zip had been one of the first tools I install on any windows installation since XP, setting it as default application to handle all archive formats it supports, .zip included. I'm surprised to see so many comments about potentially running into this bug, doesn't everyone just use 7-zip?

grumblez 8y ago
Unregistered WinRAR for life
- Slartie 8y ago
  I actually bought a license a lot of years ago because I had been using it for many more years already, always clicking that nag screen away, and some day I realized that I would be totally hosed on Windows if there was no WinRAR because it really is the only compression tool that packs good format support with a bearable user interface. 7-zip is okay on the format side since they added some of the newer high-efficiency compression algos, but the UI still sucks compared to WinRAR.
  - acct1771 8y ago
    ...there's a 7-Zip UI? I take it you're doing more than is offered in the right-click menu?
    - Slartie 8y ago
      Sure. Replacing single files deep down in some directory hierarchy in an archive. Compressing bigger amounts of files as efficient and fast as possible, so I want to customize a lot of parameters of the algorithm. Extracting many archives into separate or a common directory. Verifying archive integrity because something seems to be damaged. Encrypting stuff when compressing. I like to use a good UI for that stuff when I'm on a graphical system like Windows anyway, and WinRAR is consistently better at that than 7-Zip. I even seriously miss WinRAR when working on MacOS. Does anybody have any good suggestions for archive managers (may also be expensive ones, I don't care much if they are really good) with similar UI and functionality as WinRAR on MacOS?
ygra 8y ago
Apparently there are a lot of people also using Explorer for extracting zip files. Those end up in our support because the .NET License Compiler won't license components that have the Internet Zone black mark on them. And Explorer is the only extraction tool to my knowledge that propagates that marker to the extracted files.
skolsuper 8y ago
When I hear 7zip I associate it with security vulnerabilities. I remember reading a couple of articles last year that said 7zip was maintained and distributed by a single person with not-stellar security practices, and most mirrors online are hosting old, insecure versions. Therefore I wouldn't recommend it to anyone that doesn't "know what they're doing" wrt security. source: https://borncity.com/win/2018/02/21/security-risk-avoid-7-zip/ https://borncity.com/win/2018/02/21/security-risk-avoid-7-zi...
- lozenge 8y ago
  "most mirrors online are hosting old, insecure versions" The same can be said for every Windows software. Heck, even Windows itself. Although it offers you the option to install updates before exposing your computer to any security risks, I doubt many people are patient enough to take it.
- rrrttrrr 8y ago
  The author of that article's problems with 7zip can be summed up and dismissed like so: 1. 7zip has had security flaws - so does every other software that interacts with untrusted data, and the author admits himself that 7zip's author has responded quickly (it doesn't seem like 7zip has an abnormally high amount of exploits) 2. People are using/redistributing old versions of 7zip which are vulnerable - and that's 7zip's fault how? 7zip's own website has an easy to use and up to date installer, go after the people hosting the shitty mirrors 3. 7zip doesn't use ASLR - the author of the article literally gives the reason for this: shrinking the binary size (he then tries to pretend like this is some gaping security flaw) 4. 7zip doesn't use DEP on 32 bit windows prior to win10 - do people seriously even use 32 bit windows nowadays? (also, this is as dumb of a "flaw" as not having ASLR) Fun fact: the article's author recommends you use the OS's built in tools (aka windows explorer), so I guess I'll just have to pretend that any tar/rar/etc files don't exist
  - skolsuper 8y ago
    Isn't it a flaw though? What is the point of ASLR then? Asking as a noob

grumblez 8y ago

Unregistered WinRAR for life

Slartie 8y ago
I actually bought a license a lot of years ago because I had been using it for many more years already, always clicking that nag screen away, and some day I realized that I would be totally hosed on Windows if there was no WinRAR because it really is the only compression tool that packs good format support with a bearable user interface. 7-zip is okay on the format side since they added some of the newer high-efficiency compression algos, but the UI still sucks compared to WinRAR.
- acct1771 8y ago
  ...there's a 7-Zip UI? I take it you're doing more than is offered in the right-click menu?
  - Slartie 8y ago
    Sure. Replacing single files deep down in some directory hierarchy in an archive. Compressing bigger amounts of files as efficient and fast as possible, so I want to customize a lot of parameters of the algorithm. Extracting many archives into separate or a common directory. Verifying archive integrity because something seems to be damaged. Encrypting stuff when compressing. I like to use a good UI for that stuff when I'm on a graphical system like Windows anyway, and WinRAR is consistently better at that than 7-Zip. I even seriously miss WinRAR when working on MacOS. Does anybody have any good suggestions for archive managers (may also be expensive ones, I don't care much if they are really good) with similar UI and functionality as WinRAR on MacOS?

ygra 8y ago

Apparently there are a lot of people also using Explorer for extracting zip files. Those end up in our support because the .NET License Compiler won't license components that have the Internet Zone black mark on them. And Explorer is the only extraction tool to my knowledge that propagates that marker to the extracted files.

skolsuper 8y ago

When I hear 7zip I associate it with security vulnerabilities. I remember reading a couple of articles last year that said 7zip was maintained and distributed by a single person with not-stellar security practices, and most mirrors online are hosting old, insecure versions. Therefore I wouldn't recommend it to anyone that doesn't "know what they're doing" wrt security. source: https://borncity.com/win/2018/02/21/security-risk-avoid-7-zip/ https://borncity.com/win/2018/02/21/security-risk-avoid-7-zi...

lozenge 8y ago
"most mirrors online are hosting old, insecure versions" The same can be said for every Windows software. Heck, even Windows itself. Although it offers you the option to install updates before exposing your computer to any security risks, I doubt many people are patient enough to take it.
rrrttrrr 8y ago
The author of that article's problems with 7zip can be summed up and dismissed like so: 1. 7zip has had security flaws - so does every other software that interacts with untrusted data, and the author admits himself that 7zip's author has responded quickly (it doesn't seem like 7zip has an abnormally high amount of exploits) 2. People are using/redistributing old versions of 7zip which are vulnerable - and that's 7zip's fault how? 7zip's own website has an easy to use and up to date installer, go after the people hosting the shitty mirrors 3. 7zip doesn't use ASLR - the author of the article literally gives the reason for this: shrinking the binary size (he then tries to pretend like this is some gaping security flaw) 4. 7zip doesn't use DEP on 32 bit windows prior to win10 - do people seriously even use 32 bit windows nowadays? (also, this is as dumb of a "flaw" as not having ASLR) Fun fact: the article's author recommends you use the OS's built in tools (aka windows explorer), so I guess I'll just have to pretend that any tar/rar/etc files don't exist
- skolsuper 8y ago
  Isn't it a flaw though? What is the point of ASLR then? Asking as a noob