5 ms·

When I hear 7zip I associate it with security vulnerabilities. I remember reading a couple of articles last year that said 7zip was maintained and distributed

When I hear 7zip I associate it with security vulnerabilities. I remember reading a couple of articles last year that said 7zip was maintained and distributed by a single person with not-stellar security practices, and most mirrors online are hosting old, insecure versions. Therefore I wouldn't recommend it to anyone that doesn't "know what they're doing" wrt security. source: https://borncity.com/win/2018/02/21/security-risk-avoid-7-zip/ https://borncity.com/win/2018/02/21/security-risk-avoid-7-zi...

lozenge 8y ago
"most mirrors online are hosting old, insecure versions" The same can be said for every Windows software. Heck, even Windows itself. Although it offers you the option to install updates before exposing your computer to any security risks, I doubt many people are patient enough to take it.
rrrttrrr 8y ago
The author of that article's problems with 7zip can be summed up and dismissed like so: 1. 7zip has had security flaws - so does every other software that interacts with untrusted data, and the author admits himself that 7zip's author has responded quickly (it doesn't seem like 7zip has an abnormally high amount of exploits) 2. People are using/redistributing old versions of 7zip which are vulnerable - and that's 7zip's fault how? 7zip's own website has an easy to use and up to date installer, go after the people hosting the shitty mirrors 3. 7zip doesn't use ASLR - the author of the article literally gives the reason for this: shrinking the binary size (he then tries to pretend like this is some gaping security flaw) 4. 7zip doesn't use DEP on 32 bit windows prior to win10 - do people seriously even use 32 bit windows nowadays? (also, this is as dumb of a "flaw" as not having ASLR) Fun fact: the article's author recommends you use the OS's built in tools (aka windows explorer), so I guess I'll just have to pretend that any tar/rar/etc files don't exist
- skolsuper 8y ago
  Isn't it a flaw though? What is the point of ASLR then? Asking as a noob
  - Faark 8y ago
    I'd compare it to a classical steering-wheel lock. It makes your car a bit harder to steal. Even without it, a thief would still have to get into the car and start the engine. But not parking in a bad neighborhood will likely be a more important factor. ASLR makes it harder to exploit other bugs that might exist in the software. Browser for example should definitively use it, since they are highly complex systems while also your first line of defense against a somewhat competent attacker. As for 7zip... it also can come in contact with dubious files quite easily while also having to support lots of formats (huge attack surface with potential bugs). I'm torn, but would probably prefer it to use ASLR.

lozenge 8y ago

"most mirrors online are hosting old, insecure versions" The same can be said for every Windows software. Heck, even Windows itself. Although it offers you the option to install updates before exposing your computer to any security risks, I doubt many people are patient enough to take it.

rrrttrrr 8y ago

The author of that article's problems with 7zip can be summed up and dismissed like so: 1. 7zip has had security flaws - so does every other software that interacts with untrusted data, and the author admits himself that 7zip's author has responded quickly (it doesn't seem like 7zip has an abnormally high amount of exploits) 2. People are using/redistributing old versions of 7zip which are vulnerable - and that's 7zip's fault how? 7zip's own website has an easy to use and up to date installer, go after the people hosting the shitty mirrors 3. 7zip doesn't use ASLR - the author of the article literally gives the reason for this: shrinking the binary size (he then tries to pretend like this is some gaping security flaw) 4. 7zip doesn't use DEP on 32 bit windows prior to win10 - do people seriously even use 32 bit windows nowadays? (also, this is as dumb of a "flaw" as not having ASLR) Fun fact: the article's author recommends you use the OS's built in tools (aka windows explorer), so I guess I'll just have to pretend that any tar/rar/etc files don't exist

skolsuper 8y ago
Isn't it a flaw though? What is the point of ASLR then? Asking as a noob
- Faark 8y ago
  I'd compare it to a classical steering-wheel lock. It makes your car a bit harder to steal. Even without it, a thief would still have to get into the car and start the engine. But not parking in a bad neighborhood will likely be a more important factor. ASLR makes it harder to exploit other bugs that might exist in the software. Browser for example should definitively use it, since they are highly complex systems while also your first line of defense against a somewhat competent attacker. As for 7zip... it also can come in contact with dubious files quite easily while also having to support lots of formats (huge attack surface with potential bugs). I'm torn, but would probably prefer it to use ASLR.