4 ms·
The worst part is that WinRAR does not have autoupdate built-in, so millions of people will remain vulnerable for years.
by leonidasv 3y ago
The worst part is that WinRAR does not have autoupdate built-in, so millions of people will remain vulnerable for years.
- CamperBob2 3y ago[flagged]
- colejohnson66 3y ago> Given its Russian roots, at this point I'm nervous about updating WinRAR or otherwise continuing to use it. I wish I had a day or two to get 7Zip to build. If you're worried about backdoors, why did it take until this news for you to change your preference? Also, 7zip is available prebuilt; You don't need to compile it yourself.
- chfalck 3y agoI’ve not been able to find a signed distribution of 7-zip, so I imagine they feel safer building the repo locally to make sure they’re at least not running a compromised .exe (not suggesting the code itself is guaranteed to be virus free, but this does feel safer in my mind)
- gabereiser 3y agoapt update && apt install 7zip
- ElectricalUnion 3y ago> I’ve not been able to find a signed distribution of 7-zip Since when would a signed binary help when your "opsec" says it's the software itself that is compromised? Software can still be compromised if it is compromised before being signed. Assuming you somehow trust the source code and not the binary, in fact, you're better off compiling it yourself and checking if the non-signed software you get is similar enough to the binary you can get from others - Assuming of course you can actually reach reliable reproducible builds with a Windows build chain, a thing that last time I checked was horrible and flaky.
- gdy 3y ago[dead]
- Matl 3y ago[flagged]
- cced 3y ago[flagged]
- deleted 3y ago[deleted]
- heap_perms 3y ago> 30 million Americans marched in opposition to the Iraq war And it was an illegal. George W. Bush is a war criminal.
- deleted 3y ago[deleted]
- cynicalsecurity 3y agoThe worst part is to use a closed source proprietary black box software when there are tons of great open source alternatives, such as 7zip or even just plain good old gzip, bzip2, etc.
- MikusR 3y agoThere currently is no alternative to the built in recovery records.
- msh 3y agoThere have been a good open alternative for longer than WinRAR have had recovery records. It's called par files and there are implementations for Mac/win/Linux.
- Strom 3y agoJust to be clear, 7zip, gzip, bzip2 and others all have their own CVE's with arbitrary code execution. Open source software is not immune from these flaws. You can argue for your political beliefs, sure, but let's be honest and not claim that there are any security benefits.
- gorenb 3y agoOpen source does have some security benefits. If billions of (mostly) good people who want to help can read the code, they can find vulnerabilities more easily. Having so many contributors does help.
- Strom 3y agoThat is a popular fantasy story. The reality of almost all open source software is that nobody reads the code and the primary author is struggling to find the time to keep up with maintenance. What's more, doing security review is very hard. You can't just casually read a bit of code. You need to deeply understand the surrounding context. People who have the capability to do that aren't going around providing that service for free. -- More reading for the curious: https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://www.explainxkcd.com/wiki/index.php/2347:_Dependency
- 2OEH8eoCRo0 3y agoAuto update could allow an attacker to push a malicious update to everyone.
- ikekkdcjkfke 3y agoWindows is getting native support for rar, 7zip etc. soon. Of course, like Microsoft Defender, it will also have zero days.