He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.

Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.

Since they get theirs from an insecure source it really isnt.

No, you can get them from the official Sourceforge project over HTTPS: https://sourceforge.net/projects/sevenzip/

Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.

It's open source; feel free to fork.

sigh already downloaded the source, trying to convince myself I need to do this. The code is pretty much pure C++98 along with all the pain that comes with that.

"Secure 7-Zip" even sounds like a good name.

Agreed.

Is there a good alternative to 7-zip?

I also lost my trust into zlib recently, given that the current released version is full of bugs, and the current master is written horribly. Not as bad as openssl, but close. E.g. they are still using K&R sigs, wrong casts, and have several copy&paste bugs which you only detect with a stricter c++ compiler.

for just decompression, unarchiver has free software implementation of unrar. for compression, use command line (tar -J, zip, whatever) or file roller.

Libarchive (sometimes known as bsdtar) supports 7z with an independent implementation.

I think he means an open source unarchiver that works on windows. Obviously Linux and bad have tar/gz/bz2 etc

What are your criteria? I moved to Bandizip a few months back and it covers all of my requirements quite well.

PeaZip is pretty good and is FOSS

> PeaZip is free file archiver utility, based on Open Source technologies of 7-Zip, p7zip, FreeArc, PAQ, and PEA projects.

It seems to use 7-Zip and/or p7zip binaries.

p7zip was also patched. 18.00 doesn't have the bug, but it looks like Peazip hasn't been updated with it.

I'm not sure what other FOSS alternative to use. BandiZip is free (as in beer) but doesn't seem to have an update since Sept, so if it uses p7zip under the hood for 7z, it's also vulnerable.

Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that.

These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.

> He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated.

This attitude is much of the reason why software security is as bad as it is today. I'll take a little "bloat" over ZIP files being able to install ransomware (and security vs. performance doesn't have to be a tradeoff anyway).

Using HTTPS for downloads and signing binaries won't magically make software slower.

It's the security equivalent of washing one's hands after using the toilet...

I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.

These specific ones? Yeah, not that big a deal, but my post is about a development mindset, not the specific implementation. A few vulnerabilities show up in otherwise really great software and the idiots who browse this joint literally say the guy needs an intervention.

I don't get what you're arguing - this has nothing to do with the developer mindset. He just has to flip a compiler switch and vulnerabilities won't be trivially exploitable anymore.

It's totally irresponsible.

Well, HTTPS and high-confidence builds are popular concepts here, given that this forum is frequented by people on both side of the security fence.

At least I would assume it is. There are lots of white-hat reports, so...

No kidding. The authoritarian security cargo-culting irritates me too.

The fact that 7-zip bugs are rare enough that they make news when they are discovered already says a lot about the overall quality of the code. Many other projects with all the bloaty mitigations and other ostensibly "for security" cruft still manage to create severe bugs on a regular basis.

I read posts like this and it's just so clear to me why we're so fucked.

On the other hand, Dijkstra also has this quote which suggests he is not too fond of "mitigation" either:

"If you want more effective programmers, you will discover that they should not waste their time debugging, they should not introduce the bugs to start with."

Yes, that's why the quote was already suggesting to use better languages, but mainly it's about attitude and being aware that things go wrong, so you should turn on what you can you responsibly decided to stick to C.