4 ms·

Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid i

Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)

oriettaxx 4y ago
> Any idea of the 'why' behind this? I'm pretty curious, too > Also what is a better alternative to 7zip is 7zip necessary nowadays? can the built in zip/unzip feature be enough?
- Bluecobra 4y ago
  The built in one only supports .zip format AFAIK. 7zip supports basically everything you will come across including .rar and .gz. Also it’s nice to have the Explorer shortcuts (right click, unzip here).
  - cshokie 4y ago
    Windows has a version of tar included nowadays which helps with some of the non-zip formats (although only from the command line).
- unionpivo 4y ago
  Doesn't work on all zip files I receive. Doesn't support the bz2 and other that are quite frequent in my environment. I haven't tested it, but my perception is that it's slower when there are a lot of small files.
scrlk 4y ago
> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support) MOTW support has been introduced in v22.00 [1]: >- New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu. [1] https://www.7-zip.org/history.txt https://www.7-zip.org/history.txt
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- fzfaa 4y ago
  I didn't know anybody saw MOTW as a positive. I hate it and I don't see what problem it solves.
  - judge2020 4y ago
    Really? When it’s not you but a tech illiterate computer ‘newbie’, you don’t see any benefit to a popup warning them that “programs downloaded from the internet could be dangerous”?
    - josefx 4y ago
      Didn't we go through this with Vista? The average tech illiterate user only ends up trained to ignore and continue. You might as well drop a few hundred knives labeled "warning sharp" in the middle of a playground.
    - josephcsible 4y ago
      It's reasonable to have guessed that there'd be a benefit before it was implemented, but now that we actually have such a popup, it's clear that there's not, because the newbies all ignore its warning and run the malware anyway.
AshamedCaptain 4y ago
The entire list can be summarized into "Just use the latest versions of Microsoft everything, and uninstall all 3rd party software" (how convenient, I bet they also recommend using OneDrive). They even explicitly recommend against any 3rd party security software. Yet however 7-zip gets the boot because it apparently is not compatible with a 3rd party "Anti-Exploit" software (Malwarebytes) ?
- invokestatic 4y ago
  It’s actually not bad advice, and it feels crazy to say this considering the security of Windows was atrocious 15 years ago. At least the bundled zip extractor receives auto-updates via Windows Update. If a zero day RCE drops in 7-zip, how many users will actually be patched 6 months later? 1 year later? I would imagine it would still be a viable exploit because not many people keep their third party software up to date. Edge really does have security and isolation features that far exceed any other browser (WDAG), Windows Defender is surprisingly adequate and third-party AV software expose a substantial attack surface.
kevingadd 4y ago
7-zip is infamous at this point for having security holes, and iirc it still is compiled without things like control flow integrity or stack checks. It at least has ASLR now. For zips the windows built in support might be adequate, but I've yet to find a safe 7z unarchiver :(
- cbsks 4y ago
  I haven’t use it, but this fork of 7zip claims to have added some security features including Control Flow Guard and Control-flow Enforcement Technology (CET) Shadow Stack: https://github.com/M2Team/NanaZip https://github.com/M2Team/NanaZip
Rafert 4y ago
Was curious about 7-zip too, TIL about "origin laundering": https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ https://textslashplain.com/2016/04/04/downloads-and-the-mark...

oriettaxx 4y ago

> Any idea of the 'why' behind this? I'm pretty curious, too > Also what is a better alternative to 7zip is 7zip necessary nowadays? can the built in zip/unzip feature be enough?

Bluecobra 4y ago
The built in one only supports .zip format AFAIK. 7zip supports basically everything you will come across including .rar and .gz. Also it’s nice to have the Explorer shortcuts (right click, unzip here).
- cshokie 4y ago
  Windows has a version of tar included nowadays which helps with some of the non-zip formats (although only from the command line).
unionpivo 4y ago
Doesn't work on all zip files I receive. Doesn't support the bz2 and other that are quite frequent in my environment. I haven't tested it, but my perception is that it's slower when there are a lot of small files.

scrlk 4y ago

> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support) MOTW support has been introduced in v22.00 [1]: >- New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu. [1] https://www.7-zip.org/history.txt https://www.7-zip.org/history.txt

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
fzfaa 4y ago
I didn't know anybody saw MOTW as a positive. I hate it and I don't see what problem it solves.
- judge2020 4y ago
  Really? When it’s not you but a tech illiterate computer ‘newbie’, you don’t see any benefit to a popup warning them that “programs downloaded from the internet could be dangerous”?
  - josefx 4y ago
    Didn't we go through this with Vista? The average tech illiterate user only ends up trained to ignore and continue. You might as well drop a few hundred knives labeled "warning sharp" in the middle of a playground.
  - josephcsible 4y ago
    It's reasonable to have guessed that there'd be a benefit before it was implemented, but now that we actually have such a popup, it's clear that there's not, because the newbies all ignore its warning and run the malware anyway.

AshamedCaptain 4y ago

The entire list can be summarized into "Just use the latest versions of Microsoft everything, and uninstall all 3rd party software" (how convenient, I bet they also recommend using OneDrive). They even explicitly recommend against any 3rd party security software. Yet however 7-zip gets the boot because it apparently is not compatible with a 3rd party "Anti-Exploit" software (Malwarebytes) ?

invokestatic 4y ago
It’s actually not bad advice, and it feels crazy to say this considering the security of Windows was atrocious 15 years ago. At least the bundled zip extractor receives auto-updates via Windows Update. If a zero day RCE drops in 7-zip, how many users will actually be patched 6 months later? 1 year later? I would imagine it would still be a viable exploit because not many people keep their third party software up to date. Edge really does have security and isolation features that far exceed any other browser (WDAG), Windows Defender is surprisingly adequate and third-party AV software expose a substantial attack surface.

kevingadd 4y ago

7-zip is infamous at this point for having security holes, and iirc it still is compiled without things like control flow integrity or stack checks. It at least has ASLR now. For zips the windows built in support might be adequate, but I've yet to find a safe 7z unarchiver :(

cbsks 4y ago
I haven’t use it, but this fork of 7zip claims to have added some security features including Control Flow Guard and Control-flow Enforcement Technology (CET) Shadow Stack: https://github.com/M2Team/NanaZip https://github.com/M2Team/NanaZip

Rafert 4y ago

Was curious about 7-zip too, TIL about "origin laundering": https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ https://textslashplain.com/2016/04/04/downloads-and-the-mark...