[HN Gopher] WinRAR zero-day exploited since April to hack tradin...
___________________________________________________________________
WinRAR zero-day exploited since April to hack trading accounts
Author : mikece
Score : 153 points
Date : 2023-08-23 14:05 UTC (8 hours ago)
(HTM) web link (www.bleepingcomputer.com)
(TXT) w3m dump (www.bleepingcomputer.com)
| getarofilter wrote:
| [dead]
| milliams wrote:
| Is it really a "zero-day" if it's being used months later?
| dxd wrote:
| I think it means that this exploit has been possible since the
| application was made, the zeroth day.
| efdee wrote:
| It doesn't. Technically, zero-day in the context of exploits
| means the exploit was circulating and/or being used before
| the authors of the attacked piece of software were made aware
| of the vulnerability (or before the vulnerability was made
| public, or before the day a patch was made available,
| depending on who you ask).
| wolfi1 wrote:
| it's a zero-day when it is not patched but still exploited
| arboles wrote:
| I can stretch the definition of zero day to make a point. Zero
| day is a surprise exploit that gets used before it is
| discovered. WinRAR has not fixed this exploit, and since it's
| proprietary software we don't even know if the company is even
| aware or even cares.
|
| It's also alike a zero day in the other sense that protections
| against the exploit haven't been developed. While in a real
| zero day that's because not enough time has passed for
| volunteers to develop protections, the case here is proprietary
| software can't be modified by volunteers.
| deelowe wrote:
| Not if the devs weren't aware. Zero day borrows it's
| terminology from contracts where zero day notice means that no
| prior notification is needed. A zero day exploit is one that's
| circulating in the wild prior to their having been a formal
| disclosure.
| [deleted]
| leonidasv wrote:
| The worst part is that WinRAR does not have autoupdate built-in,
| so millions of people will remain vulnerable for years.
| [deleted]
| 2OEH8eoCRo0 wrote:
| Auto update could allow an attacker to push a malicious update
| to everyone.
| ikekkdcjkfke wrote:
| Windows is getting native support for rar, 7zip etc. soon. Of
| course, like Microsoft Defender, it will also have zero days.
| CamperBob2 wrote:
| [flagged]
| colejohnson66 wrote:
| > Given its Russian roots, at this point I'm nervous about
| updating WinRAR or otherwise continuing to use it. I wish I
| had a day or two to get 7Zip to build.
|
| If you're worried about backdoors, why did it take until this
| news for you to change your preference?
|
| Also, 7zip is available prebuilt; You don't need to compile
| it yourself.
| chfalck wrote:
| I've not been able to find a signed distribution of 7-zip,
| so I imagine they feel safer building the repo locally to
| make sure they're at least not running a compromised .exe
| (not suggesting the code itself is guaranteed to be virus
| free, but this does feel safer in my mind)
| ElectricalUnion wrote:
| > I've not been able to find a signed distribution of
| 7-zip
|
| Since when would a signed binary help when your "opsec"
| says it's the software itself that is compromised?
|
| Software can still be compromised if it is compromised
| before being signed.
|
| Assuming you somehow trust the source code and not the
| binary, in fact, you're better off compiling it yourself
| and checking if the non-signed software you get is
| similar enough to the binary you can get from others -
| Assuming of course you can actually reach reliable
| reproducible builds with a Windows build chain, a thing
| that last time I checked was horrible and flaky.
| gabereiser wrote:
| _apt update && apt install 7zip_
| gdy wrote:
| [dead]
| heap_perms wrote:
| > 30 million Americans marched in opposition to the Iraq war
|
| And it was an illegal. George W. Bush is a war criminal.
| Matl wrote:
| > Given its Russian roots
|
| > At this point, though, running unsigned Windows binaries
| built by Russian nationals
|
| Are we not dangerously close to scapegoating Russians?
| Imagine if everything American was viewed with suspicion
| after the Iraq Invasion or its athletes prevented from
| representing the US in international games.
|
| It makes one wonder. I think some Americans are still reeling
| from Cold War propaganda honestly.
|
| EDIT:
|
| > 30 million Americans marched in opposition to the Iraq war.
| What did you do when your country invaded Ukraine, besides
| attempting to justify it through logical fallacies?
|
| I am not Russian but I can see xenophobia when I see it.
|
| As for your claim that many Americans protested the Iraq War,
| they did. It made zero difference. Many Russians protested
| also, it made zero difference.
| cced wrote:
| Hey watch it pal, you're going against the narrative and
| outside the range of acceptable discourse.
| [deleted]
| cynicalsecurity wrote:
| The worst part is to use a closed source proprietary black box
| software when there are tons of great open source alternatives,
| such as 7zip or even just plain good old gzip, bzip2, etc.
| Strom wrote:
| Just to be clear, 7zip, gzip, bzip2 and others all have their
| own CVE's with arbitrary code execution. Open source software
| is not immune from these flaws.
|
| You can argue for your political beliefs, sure, but let's be
| honest and not claim that there are any security benefits.
| gorenb wrote:
| Open source does have some security benefits. If billions
| of (mostly) good people who want to help can read the code,
| they _can_ find vulnerabilities more easily. Having so many
| contributors _does_ help.
| Strom wrote:
| That is a popular fantasy story. The reality of almost
| all open source software is that nobody reads the code
| and the primary author is struggling to find the time to
| keep up with maintenance.
|
| What's more, doing security review is very hard. You
| can't just casually read a bit of code. You need to
| deeply understand the surrounding context. People who
| have the capability to do that aren't going around
| providing that service for free.
|
| -- More reading for the curious: https://www.explainxkcd.
| com/wiki/index.php/2347:_Dependency
| arboles wrote:
| Well I'm quite motivated to fix this vulnerability in
| WinRAR, but I can't.
| Strom wrote:
| You can, just download the latest version.
| arboles wrote:
| What if the software is abandoned or badly maintained? It
| took the company until August to fix it, there's the
| possibility it would be faster if it was Free software.
| MikusR wrote:
| There currently is no alternative to the built in recovery
| records.
| msh wrote:
| There have been a good open alternative for longer than
| WinRAR have had recovery records. It's called par files and
| there are implementations for Mac/win/Linux.
| bobbob1921 wrote:
| while, the article does not make this clear, I assume that, when
| dealing with an infected rar archive, if you right click, and
| choose extract, the malicious payload does not get executed.
|
| It seems you only get infected if you double click a malicious
| rat archive then within WinRAR, double click one of the
| legitimate PDF or image files.
|
| Either way, it's a bad scenario - I just would like to know. Tks
| iav wrote:
| WinRAR is (was?) developed in Russia, so it always seemed like a
| great way for the Russian FSB to hack foreign systems.
| LinuxBender wrote:
| There is a tremendous amount of software created and maintained
| by Russian developers running on Windows, MacOS and Linux. One
| example would be NGinx which runs a good deal of websites on
| the internet. NGinx is now owned by F5 but still maintain the
| same developers. There is probably a better way to verify code,
| risk rank flaws and assign a level of trust. This should be an
| ongoing _and ideally automated_ effort regardless of who is
| contributing code or hardware.
|
| I personally would like to see _AI_ be able to review entire
| code bases and see the bigger picture because state sponsored
| lawful intercepts are rarely one piece of code but rather
| require multiple pieces of code _and sometimes hardware_ to
| work in conjunction to form the back door.
| kgeist wrote:
| Yesterday I learned that a lot of crucial stuff in Postgres
| was developed by Russians (the list I saw was quite
| extensive). So if you run nginx+Postgres (like half the
| Internet?) then WinRAR is least of your concerns
| mcast wrote:
| I've met many incredibly talented eastern European
| engineers, who seem to overwhelmingly enjoy low-level
| programming (compilers, database internals, etc.). I don't
| see the concern.
| thefifthsetpin wrote:
| The Russian government has recently shown itself to be
| willing and even eager to use coercive tactics against
| its own people.
|
| The trust issues with software developed by Russians
| isn't that the engineers are Russian. It's that the
| engineers and their families are currently in Russia.
| ThrowAway1922A wrote:
| I don't what to get accused of whataboutism, but when it
| comes to software if this is the bar we're setting than
| no software can be considered safe.
| theshrike79 wrote:
| They live in a country where you can literally get
| arrested for walking around with a blank piece of paper.
| Just because you MIGHT write something subversive on it.
|
| The ability of the Russian government to lean on
| incredibly talented developers is extremely large.
| dewey wrote:
| Difference being that PG / nginx are open source and
| audited unlike WinRAR.
| LinuxBender wrote:
| That's a fair point. Perhaps a solution could be that if
| someone were willing to pick up the par2cmdline code base
| and work with the 7-zip developers to merge it into their
| command line and GUI then there may not be many reasons
| left to utilize WinRAR.
| [deleted]
| [deleted]
| nirui wrote:
| How is that conclusion came to mind? Did they wrote the entire
| code in Russian or the code just don't run on Russian
| computers?
|
| If you don't know, this is not even the first file compression
| related exploit. "Zip Slip"(0) for example, is just one year
| old, and there are many of them out there.
|
| [Zip Slip]: https://nvd.nist.gov/vuln/detail/CVE-2022-21675
| jwilk wrote:
| "Zip Slip" was a term made up in 2018 (see
| https://news.ycombinator.com/item?id=17237295) for a class of
| vulnerabilities that's been known since at least 2001.
| xxpor wrote:
| TIL, I was thrown off by the fact that it's a GmbH into
| thinking they were German.
| SillyUsername wrote:
| Well this seems to suggest they're German https://www.win-
| rar.com/cookies.html?&L=0
|
| The original author Eugene Roshal (iirc) isn't.
| chankstein38 wrote:
| This may be a good place to ask this. Legitimate question, why do
| people still use WinRAR and 7zip and stuff? Zip is built into
| literally everything. I don't really want to have to download
| another application to unpack something I get.
|
| Is there a good reason? It frequently feels like it's used just
| to make extra work for the downloader
| izackp wrote:
| 7zip supports aes-256 encryption on zip files. Windows does
| not.
| AdmiralAsshat wrote:
| .7z gets way better compression than .zip, in my experience.
| Plus, 7-zip can handle the odd archive here and there that I'm
| forced to download on my corporate PC that Windows cannot. Like
| a tarball.
|
| Finally, the built-in integrity hashing that 7-zip adds to the
| right-click context menu in Windows is crazy useful.
|
| So to answer your question: there are plenty of legitimate
| reasons to still use 7zip. I can't think of any legitimate
| reasons to still use WinRAR, though...
| rowbin wrote:
| Interesting, never heard tarballs being classified as odd
| before. They are still widely used.
| Frost1x wrote:
| If it's something you intend to package to a non-Windows
| user then sure it's not odd. I send file archives to non-
| tech users all the time internally. I absolutely do not
| tarball them, I zip them. When it comes to less tech savvy
| users, a tarball is definitely an odd format to deal with.
| distantsounds wrote:
| WinRAR can _create_ RAR files. In fact it's one of the only
| pieces of software that can. The decompression algo is free,
| so it's implemented in 7zip. compressing files in the format
| is what they want you to pay for.
| AdmiralAsshat wrote:
| Sure...but in this day and age I almost consider .rar a
| "read-only" format. There will be plenty of RAR archives
| that people are keeping around for historical reasons, but,
| why would you still be _creating_ WinRAR archives when
| there are better options?
| justsomehnguy wrote:
| > there are better options?
|
| which are?..
|
| If you need the interop then you can't beat ZIP
|
| If you need a built-in recovery record (and find a
| working decompressing program 10-20 years later) then you
| can't beat RAR
|
| If your corporate is insane and forbids 7z because it's
| FOSS/made by Russian then you can't beat RAR
|
| Which are those 'better options'?
| MikusR wrote:
| Your corporate should look up who makes WinRar.
| justsomehnguy wrote:
| Thanks, I know who and where from Eugene is.
| kupopuffs wrote:
| tar? XD
| tinus_hn wrote:
| On Usenet RAR/PAR is still the standard
| dicytea wrote:
| > The decompression algo is free
|
| Is the algorithm itself actually available somewhere? IIRC
| 7zip had compatibility issues with _some_ RAR files out
| there that opens up just fine with WinRAR, so I assumed
| they had to figure out the algo themselves.
| forgotpwd16 wrote:
| >Is the algorithm itself actually available somewhere?
|
| https://www.rarlab.com/rar_add.htm
|
| The source has the following restriction:
| UnRAR source code may be used in any software to handle
| RAR archives without limitations free of charge, but
| cannot be used to develop RAR (WinRAR)
| compatible archiver and to re-create RAR
| compression algorithm, which is proprietary.
| Distribution of modified UnRAR source code in separate
| form or as a part of other software is
| permitted, provided that full text of this
| paragraph, starting from "UnRAR source code"
| words, is included in license, or in documentation if
| license is not available, and in source code
| comments of resulting package.
| housemusicfan wrote:
| > Finally, the built-in integrity hashing that 7-zip adds to
| the right-click context menu in Windows is crazy useful.
|
| Ironic, isn't 7-Zip the program where the developer has
| famously refused to provide download hashes or digital
| signatures of the release binaries?
| LinuxBender wrote:
| One advantage of WinRAR over 7-Zip is the option to add
| recovery data and data parity recovery files. This can of
| course be accomplished on any file using PAR2 but it saved a
| step which some people liked. Not everyone needs this option.
| I create PAR files when I back up important archives to
| multiple external drives. par2cmdline [1] is in some Linux
| repositories.
|
| [1] - https://github.com/Parchive/par2cmdline [In need of a
| new maintainer]
| MikusR wrote:
| MultiPar is the continuation for Windows
| https://github.com/Yutaka-Sawada/MultiPar
|
| And this for Linux
| https://github.com/animetosho/par2cmdline-turbo
| bandergirl wrote:
| I may be wrong, but rar files appear to be recoverable when
| the download has not finished, but last time I tried I
| could not do anything with a partial 7z archive.
| cynicalsecurity wrote:
| Have you ever tried unpacking files with special characters
| from zip? Like umlauts, etc? Especially between different
| machines. It produces broken file names.
|
| Zip doesn't store access rights, unlike tar. That's why tar
| gzip is so popular on Linux.
| WeylandYutani wrote:
| I'm an old school pirate and have a cracked winrar 6.1 on my
| PC. It just works. Old habits and all that.
| jsheard wrote:
| Microsoft is (finally) adding native support for
| tar/gz/bz2/rar/7z (edit: and xz/zstd) to Windows, so third
| party apps shouldn't be required for much longer.
|
| https://blogs.windows.com/windows-insider/2023/08/18/announc...
|
| It's only available on the preview channel for now but it's
| coming.
| tssva wrote:
| Command line support for these formats has existed in Windows
| for multiple years via bsdtar which has shipped with Windows
| for quite a while now.
| [deleted]
| hulitu wrote:
| Huh ? Parent was talking about bz2, xz.
| [deleted]
| tssva wrote:
| The comment originally mentioned tar/gz/bz2/rar/7z
| support being added to Windows. bsdtar supports all of
| these.
| chankstein38 wrote:
| Niiiice!
| xxpor wrote:
| Have they added lz4 and xz as well?
| jandrese wrote:
| Please, not even Linux distros add those by default yet.
| Microsoft won't consider it until at least 2030.
| jsheard wrote:
| I don't have a preview channel install handy to check, but
| they're using libarchive so here's the full list assuming
| they expose everything it supports:
|
| https://github.com/libarchive/libarchive#supported-formats
|
| edit: amended my last reply, Microsofts latest blog post
| says that XZ and Zstd are also supported.
| lostmsu wrote:
| Great, a new attack vector.
|
| Don't get me wrong, I love that they add support for more
| open source formats, but decompressors (especially
| written in C) are one of the most common sources of bugs
| basically everywhere. I wish they would sandbox it, but
| they probably won't.
| jsheard wrote:
| Having the decompressor updated automatically by Windows
| Update is a significant step up from the current status
| quo of installing WinRAR or 7zip once and then usually
| never updating it for years because it has to be done
| manually. Microsoft will probably have more diligence in
| hardening the binaries than 7zip too, which resisted
| enabling basic exploit mitigations like DEP and ASLR
| until 2018 and _still_ doesn 't enable the more advanced
| MSVC mitigations as far as I'm aware. There's no excuse
| for that in an application that's expected to handle
| untrusted files.
| MikusR wrote:
| Covered by Microsoft Bug Bounty Program
| tssva wrote:
| This is implemented via libarchive which has actually
| shipped along with bsdtar for years now in Windows. They
| are just adding Windows explorer support for them.
| [deleted]
| msla wrote:
| I wonder how much of Windows' profusion of archive formats is a
| hangover from the MS-DOS archiver wars.
| jabroni_salad wrote:
| winrar is really good if you wish to split a big file into
| smaller chunks, since it has parity features.
| MisterBastahrd wrote:
| 7zip is great if you are zipping up your own data.
|
| RAR is used on the internet because large files get broken up
| into smaller parts to get transferred and you can use RAR to
| determine whether your compressed fileset is legitimate or if
| it needs repair. That's where recovery volumes come in. If it
| won't unrar, then you can just add enough recovery files until
| it does.
| kwanbix wrote:
| I upvoted you, as people are so intolerant today that downvote
| anything they don't like, like spoiled kids. It is crazy.
|
| That said, RAR and 7zip compress much, much better than ZIP
| (faster or more).
| chankstein38 wrote:
| Thank you, I was worried about that. I wonder about this a
| lot and HN always thought like the right place to ask!
| antihero wrote:
| Any reason that LZMA support isn't build into Windows? I think
| there's maybe some licensing issues with RAR perhaps.
| rjsw wrote:
| I have been told that 7zip handles long pathnames better than
| the zip functionality built in to Windows.
| [deleted]
| katbyte wrote:
| both provide much better compression then zip, and when you are
| compressing large amounts of compressible data that is
| important.
|
| i personally use rar (not winrar because i am not on windows)
| because it also: locks created archive, tests it, and adds a
| recovery record so if a few bits or even bytes flip it can be
| recovered.
|
| rar also has a ton of options to customize compression like
| splitting into multiple files (i think 7z does this too as
| well)
| josefresco wrote:
| .RAR file support
|
| The Windows zip tool failed just yesterday because some of my
| file names had illegal characters yet 7zip/winrar handled it no
| problem.
|
| Better compression / more options
|
| Beyond that, there's not much I need it for but every time I
| remove it ... I end up needed it shortly!
| HPsquared wrote:
| I find 7-zip is a lot faster than the Windows Explorer Zip
| handler.
| ok123456 wrote:
| That's because it supports multicore by default.
| soared wrote:
| Default unzipping in windows requires admin privileges for some
| reason on my work laptop, so I had IT install winrar so I could
| unzip without admin access.
| jandrese wrote:
| Your admins have locked down the temporary directory that the
| zip routine uses to store extracted files before copying them
| into the final location. That's the sort of paranoia that
| breaks a lot of applications in hard to diagnose ways.
| CamperBob2 wrote:
| Because some people, for reasons known only to themselves,
| still insist on using .tar files in 2023.
| ElectricalUnion wrote:
| > Zip is built into literally everything. I don't really want
| to have to download another application to unpack something I
| get.
|
| There's a more interesting question lying in there:
|
| "Zip is built into literally everything."
|
| From my anecdotal evidence with random Windows software, for
| said support, developers probably bundled 7zip in order to
| support compressed file formats.
|
| Granted, in the end the fact that 7zip is bundled, or if 7zip
| and it's several features are exposed to you as a end-user is
| another story.
| specproc wrote:
| IIRC there was some issue with non-Latin characters in
| filenames in zips on older Windows.
|
| The details escape me, but I live somewhere with a non-Latin
| script and it rars were very popular here ten-fifteen years ago
| for this reason.
| chankstein38 wrote:
| That's interesting! I feel like I've run into that as well
| pulling down a repo or something at some point!
| gruez wrote:
| You don't occasionally need to open .7z or .tar.gz files?
| ThrowAway1922A wrote:
| > You don't occasionally need to open .7z
|
| I do an I absolutely loathe when something is compressed as
| 7z.
| chankstein38 wrote:
| I do but I wouldn't if other people didn't put them in that
| format instead of zip. That said, I know tar.gz is native to
| linux so that one I understand more than 7z but this thread
| is showing there are definitely legit uses!
| MikusR wrote:
| Recovery records.
| CJefferson wrote:
| Rar seems to handle Chinese filenames much better than zip.
| tredre3 wrote:
| I use WinRAR because 7zip's handling of tar.gz/bz is abysmal.
| It first opens the .gz so you have a list containing the tar.
| Then you can double click the tar to browse it, but it will
| need to extract it fully to the temp folder first.
|
| WinRAR opens a .tar.gz like any other single-format archive
| (zip, rar, 7z) so it's much much faster, but also more
| intuitive.
|
| Even though I use WinRAR, I only create ZIPs for compatibility
| with others. I would also stick to ZIPs if I were to use 7zip.
| xxs wrote:
| >Zip is built into literally everything.
|
| Deflate is a 16bit algorithm from '91. Which is slow and the
| density is low.
| jccalhoun wrote:
| I use Nanazip which is a version of 7zip with modernization
| (although its development seems to have slowed considerably so
| I may switch back to regular 7zip) because I do run into
| compressed file other than zips. When windows 11 support for
| rar and 7z comes out I may stop using it.
| coolfission wrote:
| Probably because all those youtubers say to download WinRAR to
| extract files so people don't know that there's better
| alternatives.
|
| I also recommend NanaZip (a fork of 7zip) instead of 7zip since
| it integrates better with Windows 11 context menu.
| nonethewiser wrote:
| It's been a few years since I daily-drove windows but I
| remember that I used 7zip sometimes because the native zip
| didn't work at times. As I recall I ran into issues with it
| failing on deeply nested files.
| jcpham2 wrote:
| As a sysadmin, I frequently deploy 7zip via .msi to all
| machines that I think might even have the slightest use to open
| archive files. It's not that the OS doesn't support .zip it's
| that the OS ONLY support .zip out of the box and the OS .zip
| file manager is inadequate in many troubleshooting scenarios.
|
| Sometimes you need to split archives Sometimes you want to open
| a non-standard file type with something to unpack it
| (.xlsx/self extracting .exe) Sometimes you've got Software
| Restriction Policies that prevent standard %temp% extraction
| installers from running and need to manually extract a package.
|
| This is the short list
| dataflow wrote:
| WinRAR has way more useful options available than 7-zip. Like
| adding a recovery record, storing certain file extensions
| without compression, etc.
| oefrha wrote:
| You mean the zip feature built into Windows that will refuse to
| compress if there's any file with non-Latin1 character in its
| name, and will garble Unicode filenames compressed on other
| platforms? No I'm not talking about Windows 2000, it's the same
| in Windows 11.
|
| For ~half of the world's population it's literally useless.
| dogleash wrote:
| 7Zip - the tool not the format - is about as unobtrusive to use
| as it gets, supports every archive format we deal with on a
| regular basis, has a very tolerable license and provides better
| feedback than explorer's zip. It also handles our zip files
| that explorer is known to choke on.
|
| And because we can assume everyone in the office has 7zip, we
| don't have to create zips for things that go between windows
| and linux systems.
| mrguyorama wrote:
| >unobtrusive
|
| We are talking about the program that adds like four options
| to the right click menu throughout your entire system right?
| Eisenstein wrote:
| Arguably very useful options. For instance, try using 7zip
| to extract an .exe installer sometime -- right click on it
| and extract it into its own dir and see what is in it.
| justsomehnguy wrote:
| In the submenu. And it's useful not to wrestle with the
| unregistered filetypes or just RMB on some .exe to be able
| to unpack it.
| ls612 wrote:
| I've used 7zip for a decade and just a couple months ago I
| discovered in addition to everything I knew about already
| it also offers it also has a SHA-256 checksum tool in it's
| context menu! It is legitimately one of the most useful
| utilities on my system.
| WorldMaker wrote:
| I use Windows' built-in zip support more often than not, but
| 7zip is still handy as a "debug tool" when Windows gives up on
| a zip, or when I know a file is a zip but has a different
| extension and for whatever reason I don't want to rename it in
| that moment (skim something out of a DOCX file, for instance).
|
| Also, a common gesture I use is 7zip's extensions to the right-
| click drag file operation. I can select an entire collection of
| zip files right-click drag it to a different folder and
| "Extract to *\" which decompresses all the files into a set of
| folders (under the folder you are dragging into) using the
| names of the zip files as the folder names (minus the
| extension). This is a useful and surprisingly common operation.
| (For instance, downloading a bunch of Bandcamp albums on a
| Bandcamp Friday and decompressing them all at once to a music
| library folder.)
| WorldMaker wrote:
| Further tangent: my company still pays the zombie remains of
| Corel for WinZIP licenses and _that_ astonishes me. WinZIP is
| slow and really doesn 't seem to offer much over Windows
| built-in support, plus it still "kindly" clobbers the built-
| in support (on every reinstall/upgrade) removing it from the
| default and subtly breaking it (which I find quite
| irritating). It uselessly bloats Windows File Explorer
| tooltips and dialogs. (Why do I care what some subset of
| filenames inside the zip file are?) It doesn't seem to offer
| any useful tools, and its user interface is ugly, slow, and
| prone to crashing.
|
| WinZIP should probably have died in the 90s.
| ChrisArchitect wrote:
| Related recent other vulnerability from last week:
|
| https://news.ycombinator.com/item?id=37179505
| catboybotnet wrote:
| If you're downloading random files from a stranger's vague post,
| then I think you had it coming.
|
| The file extension spoof fix is nice, however.
| [deleted]
| bandergirl wrote:
| On a related note: Since switching to Mac a long time ago, I've
| come to love both the great support of archives by the OS (and
| The Unarchiver and more recently Keka) and the way archives are
| treated: _double-click to extract and delete._
|
| Exploring archives a-la-WinZIP has made little sense to me since
| (content previews however would still be helpful)
| [deleted]
| dingi wrote:
| Oh WinRAR. Before my time ended with Windows 10-12 years ago,
| this was one of the first programs that I install on a new
| Windows setup. Feature wise, I haven't seen any tool beat WinRAR.
| Locking, splitting, recovery support, And my favorite, SFX
| archives (msi file equivalent). Creating an installation program
| was dead easy. And they were and still are cool enough to give a
| perpetual free trial in exchange for a few nagging screens.
| Frost1x wrote:
| >Feature wise, I haven't seen any tool beat WinRAR. Locking,
| splitting, recovery support, And my favorite, SFX archives (msi
| file equivalent). Creating an installation program was dead
| easy.
|
| Doesn't 7zip do all of this (and quite a bit more)?
| rawgabbit wrote:
| I don't know about today. But WinRAR could handle very large
| files without issue. It would automatically breakup a huge
| file into a series of smaller compressed files. 7zip AFAIK
| struggled with larger files. I don't know if things have
| improved or not.
| kibibu wrote:
| That was my first encounter with RAR in the dos days -
| multiple volume archives, with each 1.44 filled to the
| brim.
___________________________________________________________________
(page generated 2023-08-23 23:02 UTC)