PeaZip: Open-source file compression and encryption software

Re:PeaZip: Open-source file compression and encryption software by jsheard on Saturday May 11, 2024 @09:48AM (#40328016)

I don't know if this is better, but 7zips developer has an unnerving track record when it comes to security practices. He resisted adopting basic mitigations like DEP and ASLR for a long time, only relenting after a security researcher basically begged him to after finding arbitrary code execution exploits, and he still doesn't want to use any more advanced hardening techniques because they (slightly) bloat the binary size or have a (tiny) performance overhead.

I'm all for lean software but breaking ASLR by stripping the relocation tables, just to shave a few kilobytes off an executable which is primarily intended to parse untrusted files is just reckless.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by lobito14 on Saturday May 11, 2024 @10:24AM (#40328280)

Can you please provide the source of this thread?

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by tylerritchie on Saturday May 11, 2024 @10:39AM (#40328381)

https://landave.io/2018/01/7-zip-multiple-memory-corruptions...

but also see: https://news.ycombinator.com/item?id=16986377

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by lobito14 on Thursday May 23, 2024 @09:36AM (#40454555)

Thank you.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by soraminazuki on Sunday May 12, 2024 @09:53AM (#40334488)

PeaZip appears to rely on 7zip for most of its supported formats. So Peazip isn't really an alternative if you want to avoid 7zip out of security concerns.

> 7z ... should be placed in (peazip)/res/bin/7z, to manage 7Z files and most of the other supported formats

https://peazip.github.io/peazip-sources.html

I personally like libarchive and its bsdtar CLI, which also supports a wide range of formats. I don't know if there's any popular GUI frontend for it though.

https://libarchive.org

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by jsheard on Sunday May 12, 2024 @12:45PM (#40335770)

The native archive support that was recently added to Windows itself is backed by libarchive.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by marwis on Sunday May 12, 2024 @04:10PM (#40337219)

Doesn't streaming architecture of libarchive make it a poor choice for working with random access archives?

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by tux21b on Saturday May 11, 2024 @11:16AM (#40328602)

I hate that PeaZip does not support passwords with a quotation mark (") in the UI. I haven't reviewed the code, but I am assuming that they are neither passing the password via a variable (linked library) nor via an execve call (less secure), but via some sub-shell which is a common attack vector and bad security practice. But as I said, I haven't reviewed the code.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by chungy on Saturday May 11, 2024 @11:46AM (#40328812)

I haven't ran nor looked at the code for PeaZip, but the website describes the program as a GUI wrapper around command line utilities. I highly suspect it's the sub-shell thing.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by fallingsquirrel on Saturday May 11, 2024 @01:51PM (#40329585)

That's concerning. What if your archive password is ;rm -rf --no-preserve-root /? There might be an easy CVE for the taking here.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by ementally on Saturday May 11, 2024 @11:01AM (#40328508)

MOTW support enabled by default https://github.com/nmantani/archiver-MOTW-support-comparison...

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by Sakos on Saturday May 11, 2024 @10:36AM (#40328357)

I've sworn by 7zip since forever and I still use it primarily, but I'd recommend peazip to anybody who wants 7zip but with a better, more convenient GUI (and workflow/behavior). I still think about switching back to peazip (only used it for a few months), but old habits die hard.

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by canistel on Saturday May 11, 2024 @09:48AM (#40328017)

Cross-platform - works on Linux (with GUI).

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by eviks on Saturday May 11, 2024 @10:14AM (#40328203)

Zstd support and x-platform

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by delfinom on Saturday May 11, 2024 @11:35AM (#40328744)

7zip 24 supports Zstd

[ Parent | on HN ]

Re:PeaZip: Open-source file compression and encryption software by Tijdreiziger on Saturday May 11, 2024 @03:09PM (#40330033)

Prettier UI (IMHO)

[ Parent | on HN ]