5 ms·

It is particularly ironic that so many people in this thread are recommending 7-zip in response to a cert problem with WinRAR when 7-zip has no code signing at

It is particularly ironic that so many people in this thread are recommending 7-zip in response to a cert problem with WinRAR when 7-zip has no code signing at all and presents the scary yellow "unknown software" screen when you try to install it.

yjftsjthsd-h 6y ago
It's a bit like the way that plaintext HTTP is way easier to deal with than HTTPS, and the way browsers treat a self-signed cert as worse than no cert. Which... does lead to some odd outcomes, yes.
- tialaramex 6y ago
  This (the "positive indication" problem in HTTPS) is gradually being fixed. Shiny new features require Secure Context so (other than on localhost) you can't do them with HTTP at all. That means things like Geolocation, WebAuthn, Service Workers, and essentially anything that's actually novel (couldn't just be polyfilled with Javascript). There are even old features getting deprecated in non-Secure Contexts because in hindsight we should have required Secure Context but it was hard to pull the trigger. For example EME (the DRM for some video content online) will probably require Secure Context. Browsers are also adding back scary warnings for some more basic features like form submission when used without Secure Context. And some domains (including entire TLDs) are locked down to forbid HTTP anyway. If you type in an HTTP URL in those domains it's rewritten as HTTPS and you can't undo that† † Some browsers can override this as a corporate policy, so if your company really wants to be less secure it can disable the upgrades for some or all domains. But out of the box this is how the browser behaves.
dependenttypes 6y ago
People are not recommending 7-zip in response to the cert problem but rather to someone directly asking for a superior alternative in https://news.ycombinator.com/item?id=24284253 https://news.ycombinator.com/item?id=24284253 Regardless, 7zip does not have as much of a need for a certificate because it is foss so you do not need to trust the creators, in comparison to winrar which isn't and you need to trust them.
- rgj 6y ago
  The fact that it is FOSS makes it _easier_ for someone to compile it with a backdoor or trojan. I would say the need for a certificate is _higher_ there. You don’t need to trust the developers, you need to be able to trust the people who have built the executable.
  - gus_massa 6y ago
    For example, for some time SourceForge used to offer the executable with their own "installer" https://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/ https://www.howtogeek.com/218764/warning-don%E2%80%99t-downl...
  - dependenttypes 6y ago
    Well, viruses existed for ages, so I do not think that it really makes it easier. The reason that you do not need a signed executable as much is that people can just compile one themselves.
Arnavion 6y ago
The scary yellow screen that everyone clicks through anyway. I don't think 7zip needs to worry about that harming its adoption. Codesigning is a protection racket, and FOSS should not feel pressured to participate in it.
GuB-42 6y ago
I didn't even realize that the "scary" yellow prompt was related to code signing. For me it was just what happens when you run an executable from the internet. Do anyone pays attention to this? There is a lot of legitimate software you can't install without clicking through. 7-zip is just one of them.
- stefan_ 6y ago
  Just code signing your application isn't enough, it needs to get enough reputation from enough Windows spyware bots reporting they installed your program: https://www.digicert.com/blog/ms-smartscreen-application-reputation/#:~:text=Application%20reputation%20is%20a%20method,is%20downloaded%20from%20the%20Internet https://www.digicert.com/blog/ms-smartscreen-application-rep....

yjftsjthsd-h 6y ago

It's a bit like the way that plaintext HTTP is way easier to deal with than HTTPS, and the way browsers treat a self-signed cert as worse than no cert. Which... does lead to some odd outcomes, yes.

tialaramex 6y ago
This (the "positive indication" problem in HTTPS) is gradually being fixed. Shiny new features require Secure Context so (other than on localhost) you can't do them with HTTP at all. That means things like Geolocation, WebAuthn, Service Workers, and essentially anything that's actually novel (couldn't just be polyfilled with Javascript). There are even old features getting deprecated in non-Secure Contexts because in hindsight we should have required Secure Context but it was hard to pull the trigger. For example EME (the DRM for some video content online) will probably require Secure Context. Browsers are also adding back scary warnings for some more basic features like form submission when used without Secure Context. And some domains (including entire TLDs) are locked down to forbid HTTP anyway. If you type in an HTTP URL in those domains it's rewritten as HTTPS and you can't undo that† † Some browsers can override this as a corporate policy, so if your company really wants to be less secure it can disable the upgrades for some or all domains. But out of the box this is how the browser behaves.

dependenttypes 6y ago

People are not recommending 7-zip in response to the cert problem but rather to someone directly asking for a superior alternative in https://news.ycombinator.com/item?id=24284253 https://news.ycombinator.com/item?id=24284253 Regardless, 7zip does not have as much of a need for a certificate because it is foss so you do not need to trust the creators, in comparison to winrar which isn't and you need to trust them.

rgj 6y ago
The fact that it is FOSS makes it _easier_ for someone to compile it with a backdoor or trojan. I would say the need for a certificate is _higher_ there. You don’t need to trust the developers, you need to be able to trust the people who have built the executable.
- gus_massa 6y ago
  For example, for some time SourceForge used to offer the executable with their own "installer" https://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/ https://www.howtogeek.com/218764/warning-don%E2%80%99t-downl...
- dependenttypes 6y ago
  Well, viruses existed for ages, so I do not think that it really makes it easier. The reason that you do not need a signed executable as much is that people can just compile one themselves.

Arnavion 6y ago

The scary yellow screen that everyone clicks through anyway. I don't think 7zip needs to worry about that harming its adoption. Codesigning is a protection racket, and FOSS should not feel pressured to participate in it.

GuB-42 6y ago

I didn't even realize that the "scary" yellow prompt was related to code signing. For me it was just what happens when you run an executable from the internet. Do anyone pays attention to this? There is a lot of legitimate software you can't install without clicking through. 7-zip is just one of them.

stefan_ 6y ago
Just code signing your application isn't enough, it needs to get enough reputation from enough Windows spyware bots reporting they installed your program: https://www.digicert.com/blog/ms-smartscreen-application-reputation/#:~:text=Application%20reputation%20is%20a%20method,is%20downloaded%20from%20the%20Internet https://www.digicert.com/blog/ms-smartscreen-application-rep....