5 ms·
The developer of 7-zip has a questionable approach to security for an application that's meant to handle untrusted files, he prioritizes small binary size above
by jsheard 3y ago
The developer of 7-zip has a questionable approach to security for an application that's meant to handle untrusted files, he prioritizes small binary size above hardening against exploits most of the time. DEP was disabled until 64-bit Windows forced the issue by making it mandatory, ASLR was disabled until fairly recently because he considered relocation tables to be unnecessary bloat, and the more advanced mitigations like CET and CFG still aren't used to this day. I don't know how robust the actual code is, but an attitude of executable size being the most important metric doesn't fill me with confidence that it tries to handle all possible edge cases.
With Windows 11 now having support for 7z/rar/etc built-in I'd be inclined to just default to using that if it covers your use-cases.
- MrYellowP 3y agoQuestion. Does Microsoft have to pay a license for being able to support RAR or are they now effectively putting winrar out of business?
- frankjr 3y agoI don't know but this is their response to the Microsoft's announcement. https://twitter.com/WinRAR_RARLAB/status/1663493174642323457 https://twitter.com/WinRAR_RARLAB/status/1663493174642323457
- wongarsu 3y agoThe unrar cli is published under a source-available license that you can't use it to build a rar compressor. So using knowledge from reading that might be fair game for building a rar decompressor, especially if you follow the usual clean-room protocols (one person reads the code and writes documentation, the other reads the documentation and writes new code). Not sure how that will affect winrar in the long term. Of course people now aren't forced to download software to open rar files. But it also makes it much more viable to send .rar files to random people. And actual Winrar still offers you a lot of features that Windows doesn't have and seems to be a lot faster, so there are still plenty of reasons for power users to use it. Personally I own a winrar license primarily for its features when creating archives, and Windows isn't encroaching on that.
- orra 3y ago> Windows 11 now having support for 7z/rar/etc built-in I'd be inclined to just default to using that if it covers your use-cases. I hope Microsoft is keeping bsdtar/libarchive up to date. IIRC they weren't.
- jsheard 3y agoConsidering neither WinRAR or 7-zip update themselves automatically, and most people never bother to update them manually, I'm not sure that's any worse than the status quo. The libraries bundled into Windows at least could be kept up to date by Windows Update.