4 ms·

Can anyone explain why this is better than 7zip?

jsheard 2y ago
I don't know if this is better, but 7zips developer has an unnerving track record when it comes to security practices. He resisted adopting basic mitigations like DEP and ASLR for a long time, only relenting after a security researcher basically begged him to after finding arbitrary code execution exploits, and he still doesn't want to use any more advanced hardening techniques because they (slightly) bloat the binary size or have a (tiny) performance overhead. I'm all for lean software but breaking ASLR by stripping the relocation tables, just to shave a few kilobytes off an executable which is primarily intended to parse untrusted files is just reckless.
- lobito14 2y ago
  Can you please provide the source of this thread?
  - tylerritchie 2y ago
    https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ https://landave.io/2018/01/7-zip-multiple-memory-corruptions... but also see: https://news.ycombinator.com/item?id=16986377 https://news.ycombinator.com/item?id=16986377
    - lobito14 2y ago
      Thank you.
- soraminazuki 2y ago
  PeaZip appears to rely on 7zip for most of its supported formats. So Peazip isn't really an alternative if you want to avoid 7zip out of security concerns. > 7z ... should be placed in (peazip)/res/bin/7z, to manage 7Z files and most of the other supported formats https://peazip.github.io/peazip-sources.html https://peazip.github.io/peazip-sources.html I personally like libarchive and its bsdtar CLI, which also supports a wide range of formats. I don't know if there's any popular GUI frontend for it though. https://libarchive.org https://libarchive.org
  - jsheard 2y ago
    The native archive support that was recently added to Windows itself is backed by libarchive.
    - marwis 2y ago
      Doesn't streaming architecture of libarchive make it a poor choice for working with random access archives?
canistel 2y ago
Cross-platform - works on Linux (with GUI).
eviks 2y ago
Zstd support and x-platform
- delfinom 2y ago
  7zip 24 supports Zstd
Sakos 2y ago
I've sworn by 7zip since forever and I still use it primarily, but I'd recommend peazip to anybody who wants 7zip but with a better, more convenient GUI (and workflow/behavior). I still think about switching back to peazip (only used it for a few months), but old habits die hard.
ementally 2y ago
MOTW support enabled by default https://github.com/nmantani/archiver-MOTW-support-comparison#comparison-table-of-motw-propagation-support-as-of-11-february-2024 https://github.com/nmantani/archiver-MOTW-support-comparison...
tux21b 2y ago
I hate that PeaZip does not support passwords with a quotation mark (") in the UI. I haven't reviewed the code, but I am assuming that they are neither passing the password via a variable (linked library) nor via an execve call (less secure), but via some sub-shell which is a common attack vector and bad security practice. But as I said, I haven't reviewed the code.
- chungy 2y ago
  I haven't ran nor looked at the code for PeaZip, but the website describes the program as a GUI wrapper around command line utilities. I highly suspect it's the sub-shell thing.
  - fallingsquirrel 2y ago
    That's concerning. What if your archive password is ;rm -rf --no-preserve-root /? There might be an easy CVE for the taking here.
Tijdreiziger 2y ago
Prettier UI (IMHO)

I don't know if this is better, but 7zips developer has an unnerving track record when it comes to security practices. He resisted adopting basic mitigations like DEP and ASLR for a long time, only relenting after a security researcher basically begged him to after finding arbitrary code execution exploits, and he still doesn't want to use any more advanced hardening techniques because they (slightly) bloat the binary size or have a (tiny) performance overhead. I'm all for lean software but breaking ASLR by stripping the relocation tables, just to shave a few kilobytes off an executable which is primarily intended to parse untrusted files is just reckless.

lobito14 2y ago
Can you please provide the source of this thread?
- tylerritchie 2y ago
  https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ https://landave.io/2018/01/7-zip-multiple-memory-corruptions... but also see: https://news.ycombinator.com/item?id=16986377 https://news.ycombinator.com/item?id=16986377
  - lobito14 2y ago
    Thank you.
soraminazuki 2y ago
PeaZip appears to rely on 7zip for most of its supported formats. So Peazip isn't really an alternative if you want to avoid 7zip out of security concerns. > 7z ... should be placed in (peazip)/res/bin/7z, to manage 7Z files and most of the other supported formats https://peazip.github.io/peazip-sources.html https://peazip.github.io/peazip-sources.html I personally like libarchive and its bsdtar CLI, which also supports a wide range of formats. I don't know if there's any popular GUI frontend for it though. https://libarchive.org https://libarchive.org
- jsheard 2y ago
  The native archive support that was recently added to Windows itself is backed by libarchive.
  - marwis 2y ago
    Doesn't streaming architecture of libarchive make it a poor choice for working with random access archives?

canistel 2y ago

Cross-platform - works on Linux (with GUI).

eviks 2y ago

Zstd support and x-platform

delfinom 2y ago
7zip 24 supports Zstd

Sakos 2y ago

I've sworn by 7zip since forever and I still use it primarily, but I'd recommend peazip to anybody who wants 7zip but with a better, more convenient GUI (and workflow/behavior). I still think about switching back to peazip (only used it for a few months), but old habits die hard.

ementally 2y ago

MOTW support enabled by default https://github.com/nmantani/archiver-MOTW-support-comparison#comparison-table-of-motw-propagation-support-as-of-11-february-2024 https://github.com/nmantani/archiver-MOTW-support-comparison...

tux21b 2y ago

I hate that PeaZip does not support passwords with a quotation mark (") in the UI. I haven't reviewed the code, but I am assuming that they are neither passing the password via a variable (linked library) nor via an execve call (less secure), but via some sub-shell which is a common attack vector and bad security practice. But as I said, I haven't reviewed the code.

chungy 2y ago
I haven't ran nor looked at the code for PeaZip, but the website describes the program as a GUI wrapper around command line utilities. I highly suspect it's the sub-shell thing.
- fallingsquirrel 2y ago
  That's concerning. What if your archive password is ;rm -rf --no-preserve-root /? There might be an easy CVE for the taking here.

Tijdreiziger 2y ago

Prettier UI (IMHO)