4 ms·

7zip.com has never been the official website of the project. It's been 7-zip.org

by Dwedit 8mo ago

pibaker 8mo ago
How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?
- antisthenes 8mo ago
  > How can the average 7zip user know which one it is? I dunno, if you type "download 7zip" into Google, the top result is the official website. Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website. This is actually a pretty good case of the regular user being pretty safe from downloading malware.
  - sedatk 8mo ago
    > I dunno, if you type "download 7zip" into Google, the top result is the official website. Until someone puts an ad above it.
    - 8organicbits 8mo ago
      Sure, but the answer to "How can the average 7zip user know which one it is?" would then be "do a Google search and use uBlock Origin".
      - pixl97 8mo ago
        How does the user know they are using the official uBlock Origin?
        8organicbits 8mo ago
        The Mozilla extension store doesn't have ads, so it's the top item. It has clear download counts and a "recommended" icon. So the advice is to install it from the extension store.
  - pibaker 8mo ago
    I feel I need to clarify my earlier comment. I was asking how can a user tell, in general, what is the legitimate website of a software, not just how to know what 7zip.com is malicious. Are the search removals and phishing warnings reactive or proactive? Because if it is the former then we don't really know how many users are already affected before security researchers got notified and took action. Also, 7zip is not the only software to be affected by similar domain squatting "attacks." If you search for PuTTY, the unofficial putty.org website will be very high on the list (top place when I googled "download putty.") While it is not serving malware, yet, the fact that the more legitimate sounding domain is not controlled by the original author does leave the door open for future attacks.
    - layer8 8mo ago
      One way is to consult the same source(s) where the user learned about the software in the first place.
  - TiredOfLife 8mo ago
    > Also, 7zip.com is nowhere on the first page In incognito window, for me, it's 3rd result
    - antisthenes 8mo ago
      It's possible, although I can't replicate this result anymore. On google search I don't see it on the first page, and the only sketchy link on page 2 is https://7zip.dev/en/download/ https://7zip.dev/en/download/. Bing is worse, since it shows 7zip.com on the 2nd page, but the site refuses to load. But I am using Thorium with manifest v2 ublock and Edge with medium setting for tracker/ad block.
  - deleted 8mo ago
    [deleted]
- n4bz0r 8mo ago
  There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.
  - throwaway198846 8mo ago
    So wikipedia is now part of the supply chain (informally) which means there is another set of people who will try to hijack Wikipedia, as if we didn't had enough, just great.
    - jamespo 8mo ago
      What's your solution? If you search google for 7-zip the official website is the first hit.
    - lyu07282 8mo ago
      I was always impressed by how fast wikipedia editors revert that kind of stuff, so I think it's great advice actually!
    - n4bz0r 8mo ago
      Not exactly news, wiki's been used for misinformation quite extensively from what I recall. You can't always be 100% sure with any online source of information, but at least you know there is an extensive community that'll notice if something's fishy rather sooner than later.
    - jolmg 8mo ago
      You can corroborate multiple trusted sources, especially those with histories. You can check the edit history of the Wikipedia article. Also, if you search "7zip" on HN, the second result with loads of votes and comments is 7-zip.org. Another is searching the Archlinux package repos; you can check the git history of the package build files to see where it's gotten the source from.
      - 8mo ago
- deleted 8mo ago
  [deleted]
- rtcode_io 8mo ago
  1. Go to the wikipedia article on 7-Zip 2. Go the listed homepage
- Markoff 8mo ago
  open About in the app?
- imglorp 8mo ago
  Open source software will have a code repo with active development happening on it. That repo will usually link to official Web page and download places.
  - lukan 8mo ago
    Not universal true. Open source just means that the code is avaiable, not that developement happens in the open. (But 7zip does have a github repo)
  - Someone 8mo ago
    The fork with malware embedded could fairly easily apply most commits to the main repo in its public repo. They could even have support pages that look real, by copying them from the legitimate site. And the process of creating a repo that stays in sync with another fork can be automated, so, if needed, malware writers likely will do that.
- harladsinsteden 8mo ago
  How would you ensure that the "average user" actually gets to the page he expects to get to? There are risks in everything you do. If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all?
  - KronisLV 8mo ago
    > How would you ensure that the "average user" actually gets to the page he expects to get to? I think you practically can't and that's the problem. TLS doesn't help with figuring out which page is the real one, EV certs never really caught on and most financial incentives make such mechanisms unviable. Same for additional sources of information like Wikipedia, since that just shifts the burden of combatting misinformation on the editors there and not every project matters enought to have a page. You could use an OS with a package manager, but not all software is packaged like that and that doesn't immediately make it immune to takeovers or bad actors. An unreasonable take would be: > A set of government run repositories and mirrors under a new TLD which is not allowed for anything other than hosting software packages, similar to how .gov ones already owrk - be it through package manager repositories or websites. Only source can be submitted by developers, who also need their ID verified and need to sign every release, it then gets reviewed by the employees and is only published after automated checks as well. Anyone who tries funny business, goes to jail. The unfortunate side effect is that you now live in a dystopia and go to jail anyways. A more reasonable take would be that it's not something you can solve easily. > If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all? People die in car crashes. We can't eliminate those altogether, but at least we can take steps towards making things better, instead of telling them that maybe they should just not drive. Tough problems regardless.
    - harladsinsteden 8mo ago
      > People die in car crashes. We can't eliminate those altogether, but at least we can take steps towards making things better, instead of telling them that maybe they should just not drive. Tough problems regardless. I agree with the sentiment but there are limits to what we can and should do. To stay with your analogy: We don't let people drive around without taking a test. In that test they have to prove that they know the basics of how to drive a car. At least where I come from that means learning quite a bit of rules and regulations. In other words: Don't let people off the hook. They need to do some form of learning by themselves. It's no different with what you do on the internet. If you're not willing to do some kind of work to familiarize yourself with how the bloody thing work then it's not the job of everyone else to make sure you'll be okay. It's _your_ job to understand the basics. I'm getting tired of just another thing we must take off peoples minds so that they can "just" use whatever they want to use. Don't try to blame (or god forbid sue) someone else because you didn't do your homework.
- cermicelli 8mo ago
  Avoid downloading stuff of internet and avoid search engines. In a post AI world asking how not be scammed is hard cause now everything can be faked. Trust what you definitely know but still verify. Especially in the next 5-10 years that's going to become the reality so I guess sit tight and prepare for the waves and sunamis of scams.
- Lockal 8mo ago
  Fails to load for me with: "The page was blocked because of a matching filter in uBlock filters – Badware risks." Which is enabled by default in uBlock. And installing it is pretty much a standard suggestion for any web user.

7zip.com has never been the official website of the project. It's been 7-zip.org

by Dwedit 8mo ago

7zip.com has never been the official website of the project. It's been 7-zip.org

How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?

antisthenes 8mo ago
> How can the average 7zip user know which one it is? I dunno, if you type "download 7zip" into Google, the top result is the official website. Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website. This is actually a pretty good case of the regular user being pretty safe from downloading malware.
- sedatk 8mo ago
  > I dunno, if you type "download 7zip" into Google, the top result is the official website. Until someone puts an ad above it.
  - 8organicbits 8mo ago
    Sure, but the answer to "How can the average 7zip user know which one it is?" would then be "do a Google search and use uBlock Origin".
    - pixl97 8mo ago
      How does the user know they are using the official uBlock Origin?
      - 8organicbits 8mo ago
        The Mozilla extension store doesn't have ads, so it's the top item. It has clear download counts and a "recommended" icon. So the advice is to install it from the extension store.
- pibaker 8mo ago
  I feel I need to clarify my earlier comment. I was asking how can a user tell, in general, what is the legitimate website of a software, not just how to know what 7zip.com is malicious. Are the search removals and phishing warnings reactive or proactive? Because if it is the former then we don't really know how many users are already affected before security researchers got notified and took action. Also, 7zip is not the only software to be affected by similar domain squatting "attacks." If you search for PuTTY, the unofficial putty.org website will be very high on the list (top place when I googled "download putty.") While it is not serving malware, yet, the fact that the more legitimate sounding domain is not controlled by the original author does leave the door open for future attacks.
  - layer8 8mo ago
    One way is to consult the same source(s) where the user learned about the software in the first place.
- TiredOfLife 8mo ago
  > Also, 7zip.com is nowhere on the first page In incognito window, for me, it's 3rd result
  - antisthenes 8mo ago
    It's possible, although I can't replicate this result anymore. On google search I don't see it on the first page, and the only sketchy link on page 2 is https://7zip.dev/en/download/ https://7zip.dev/en/download/. Bing is worse, since it shows 7zip.com on the 2nd page, but the site refuses to load. But I am using Thorium with manifest v2 ublock and Edge with medium setting for tracker/ad block.
- deleted 8mo ago
  [deleted]
n4bz0r 8mo ago
There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.
- throwaway198846 8mo ago
  So wikipedia is now part of the supply chain (informally) which means there is another set of people who will try to hijack Wikipedia, as if we didn't had enough, just great.
  - jamespo 8mo ago
    What's your solution? If you search google for 7-zip the official website is the first hit.
  - lyu07282 8mo ago
    I was always impressed by how fast wikipedia editors revert that kind of stuff, so I think it's great advice actually!
  - n4bz0r 8mo ago
    Not exactly news, wiki's been used for misinformation quite extensively from what I recall. You can't always be 100% sure with any online source of information, but at least you know there is an extensive community that'll notice if something's fishy rather sooner than later.
  - jolmg 8mo ago
    You can corroborate multiple trusted sources, especially those with histories. You can check the edit history of the Wikipedia article. Also, if you search "7zip" on HN, the second result with loads of votes and comments is 7-zip.org. Another is searching the Archlinux package repos; you can check the git history of the package build files to see where it's gotten the source from.
    - 8mo ago
deleted 8mo ago
[deleted]
rtcode_io 8mo ago
1. Go to the wikipedia article on 7-Zip 2. Go the listed homepage
Markoff 8mo ago
open About in the app?
imglorp 8mo ago
Open source software will have a code repo with active development happening on it. That repo will usually link to official Web page and download places.
- lukan 8mo ago
  Not universal true. Open source just means that the code is avaiable, not that developement happens in the open. (But 7zip does have a github repo)
- Someone 8mo ago
  The fork with malware embedded could fairly easily apply most commits to the main repo in its public repo. They could even have support pages that look real, by copying them from the legitimate site. And the process of creating a repo that stays in sync with another fork can be automated, so, if needed, malware writers likely will do that.
harladsinsteden 8mo ago
How would you ensure that the "average user" actually gets to the page he expects to get to? There are risks in everything you do. If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all?
- KronisLV 8mo ago
  > How would you ensure that the "average user" actually gets to the page he expects to get to? I think you practically can't and that's the problem. TLS doesn't help with figuring out which page is the real one, EV certs never really caught on and most financial incentives make such mechanisms unviable. Same for additional sources of information like Wikipedia, since that just shifts the burden of combatting misinformation on the editors there and not every project matters enought to have a page. You could use an OS with a package manager, but not all software is packaged like that and that doesn't immediately make it immune to takeovers or bad actors. An unreasonable take would be: > A set of government run repositories and mirrors under a new TLD which is not allowed for anything other than hosting software packages, similar to how .gov ones already owrk - be it through package manager repositories or websites. Only source can be submitted by developers, who also need their ID verified and need to sign every release, it then gets reviewed by the employees and is only published after automated checks as well. Anyone who tries funny business, goes to jail. The unfortunate side effect is that you now live in a dystopia and go to jail anyways. A more reasonable take would be that it's not something you can solve easily. > If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all? People die in car crashes. We can't eliminate those altogether, but at least we can take steps towards making things better, instead of telling them that maybe they should just not drive. Tough problems regardless.
  - harladsinsteden 8mo ago
    > People die in car crashes. We can't eliminate those altogether, but at least we can take steps towards making things better, instead of telling them that maybe they should just not drive. Tough problems regardless. I agree with the sentiment but there are limits to what we can and should do. To stay with your analogy: We don't let people drive around without taking a test. In that test they have to prove that they know the basics of how to drive a car. At least where I come from that means learning quite a bit of rules and regulations. In other words: Don't let people off the hook. They need to do some form of learning by themselves. It's no different with what you do on the internet. If you're not willing to do some kind of work to familiarize yourself with how the bloody thing work then it's not the job of everyone else to make sure you'll be okay. It's _your_ job to understand the basics. I'm getting tired of just another thing we must take off peoples minds so that they can "just" use whatever they want to use. Don't try to blame (or god forbid sue) someone else because you didn't do your homework.
cermicelli 8mo ago
Avoid downloading stuff of internet and avoid search engines. In a post AI world asking how not be scammed is hard cause now everything can be faked. Trust what you definitely know but still verify. Especially in the next 5-10 years that's going to become the reality so I guess sit tight and prepare for the waves and sunamis of scams.
Lockal 8mo ago
Fails to load for me with: "The page was blocked because of a matching filter in uBlock filters – Badware risks." Which is enabled by default in uBlock. And installing it is pretty much a standard suggestion for any web user.