605
WinRAR flaw lets hackers run programs when you open RAR archives
(www.bleepingcomputer.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 19 Aug 2023
605 points (99.0% liked)
Technology
59559 readers
2245 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
I never understood the appeal of paid programs. 7-Zip works equally well and is free and open source software. It integrates much nicer into File Explorer as well.
Supporting the developers??
I agree that 7zip is great (albeit based in Russia, so not something I'm sure I want to support at the moment), but consider for a moment that winrar licencing is primarily aimed at businesses (which is why they don't bother locking personal users out after the trial ends), and for that money you get a certain guarantee of functionality and stability over a long period of time.
There's absolutely no guarantees that 7zip will continue to be developed, or that it will retain it's current features and functionality - the developer can turn it into a Minesweeper clone if they feel like it, and there's nothing a business can do but keep using an outdated and thus potentially dangerous version that will eventually become unusable.
You also get a certain level of customer service and corporate communication between the purchasing company and the production company to help resolve issues, which may not exist at all with the alternative.
It's also not always wise to have your business rely heavily on a tool that only sees development through volunteer work by a limited number of disparate people that may come and go, and while I don't know how large the volunteer base is that works on 7zip (it could be just the one guy, it could be a hundred people), to a company it'll never feel as reliable an option as relying on a tool that sees development and maintenance through a paid, full time staff at an established legal entity company with an established reputation.
And speaking for a moment to that established company bit, consider that winrar's company is based in Berlin, within the European Union and under it's rules and laws, which is a far better proposition from a company's standpoint than having to legally deal with an individual guy inside the Russian Federation, especially one that hasn't actually sold your business a product at all.
Anyway, just a few potential thoughts for why tools that do the same job might be preferred by a business, sorry it got a bit long 😅
I mean, does paying for winrar somehow guarantee that it will keep being actively developed?
No, the fact that businesses pay for it for something of that guarantee despite there being free peer-alternatives means that it is a better guarantee.
When you see businesses electing to pay for something despite free alternatives, there is likely a reason (or a number of them). I've seen free tools go from active maintaining to completely dead in a single update due to the work needed to get it back up and operating with new environment-side changes.
And we've all seen companies go out of business overnight. There's no more guarantee that WinRAR will still be around tomorrow than there is for 7z.
7zip is FOSS, GPL license. Even if the author stops others can step in. Even if nobody does and it stops being actively developed you'll still be able to extract your archives for the foreseeable future. You can still unpack ARC files from the 80s.
Yep, I run a number of Linux distros. Debian to Arch. They all handle 7z with no fuss.
Just because someone was born in Russia does not make them a specific type of person. Nobody chooses where or when they are born. 7-Zip has been for ages, and if something were to happen to it then im sure one of the dozen of forks around will take the role as the "main one". However you are right, companies desire something predictable, stable. Which is why some companies like SUSE, Red Hat, etc. Manage to sell FOSS. in fact i believe some of these distros include p7zip, and they freeze it to a specific version, security updates and bug fixes are backported.
On Mac, The Unarchiver is always the correct choice.
… You can’t edit files inside a zip file. The program’s just hiding that it’s decompressing and decompressing the whole thing every time you change something.
Zip files are usually just another wrapper around DEFLATE, and compressing each block requires knowledge of the previous block’s compression (Part of LZ77). It’s a streaming format, not a sparse format.
RAR != ZIP.
Fell free to read a stack overflow about that situation
Your choices are basically “rewrite the entire file” or “leave the original file in place, do an append and try and hide the old file.”
Editing old data in most streaming file formats with inline metadata is basically impossible because they compact the data as much as possible and internally refer to offsets.
Appending is trivial, editing is very hard if not downright impossible.
If you edit a text file, it actually just creates a new file because inserting text in the middle means all of the text after changes position. I'd still call that editing an existing file rather than creating a new file based on the previous one plus some edits. The second description might be more technically accurate but it's just unnecessary technical details because it's effectively the first description.
Even going back to the original use of edit, editors would mark up books or articles and then a new copy would need to be created with those edits. I'm having trouble thinking of any cases where edit truly means "change something in place without making a new copy of it with the changes included". I guess small edits with pencil or whiteout can sometimes work.
However, WinRAR in this case is also the one that puts your business at risk.
I like WinRAR for its built-in parity functionality. You can achieve similar results with 7-Zip using PAR2, but having it built right into WinRAR with two options (add a recovery record to each archive, or create separate recovery archives (basically what PAR2 does)) is so much more convenient.
WinRAR is like what..? 30-35 bucks? That's per user, unlimited machines, lifetime license. More than fair I'd say.
WinRAR has so much better UI than 7zip.
I will honestly move away from WinRAR if something better with dark theme is launched.
I have tried PeaZip Multiple times and have always turned away. It has significant startup & load time compared to WinRAR.
Lol wooosh I guess?
Microsoft basically copied WinRAR added it to the OS, back in the windows 7 days you needed WinRAR
Implementing support for a widely used format isn’t “basically copied” and there have been alternatives for decades.
Back in the Windows 7 days you could use 7zip. I've been using it since like XP
WinRar decompresses directly to destination. All other I have tried does it to like c:/tmp (can probably change that though) then copy it over, which is impractical or even impossible with really large files.
That's about it though IMO.
You can decompress directly to the destination with 7zip as well. You just need to use the "extract" button instead of doing a drag and drop.
Cool thanks for the info, I did it by script but then trere is maybe some option I didn't find...
Downvote all you want, but you can configure WinRAR to decompress directly to source.
I had TB files and just no space to have both a copy and the result, IIRC the speed was also obviously better without copying.