Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple 7-Zip Vulnerabilities Discovered

blog.talosintel.com

Post reply on HN
Print view View original

41–50 of 72 posts

Re: Multiple 7-Zip Vulnerabilities Discovered

#41

Post by striking »

de47 wrote: post #38
striking wrote: post #35

Earlier quoted context omitted.

Anyone's within their right to criticize an open source project. I think being "appalled" is a tad illogical, though. Similarly, does complaining about it on a public forum have any effect? In my book, code speaks louder than words; if you really want to see change, you know what to do.

Being appalled seems right to me. Under many circumstances, our actions come with a certain degree of responsibility. When we write code, we have the responsibility to be pretty open about security.

Our actions do come with a certain degree of responsibility. It is the user's responsibility, then, not to use software that is "without warranty" if they do not firmly trust it.

You can claim irresponsibility whenever you want, but it takes two to tango.

Re: Multiple 7-Zip Vulnerabilities Discovered

#42

Post by abcd_f »

ck2 wrote: post #26

Darn 16.0 upgrade insisted on rebooting my Windows. Should not be necessary in 2016

Explorer integration is a finicky business.

One huge tangle of dependencies, most of which concealed by COM abstractions. Even if you kill explorer.exe, something somewhere may end up holding a reference to your binary with a reboot being the only way around it.

Re: Multiple 7-Zip Vulnerabilities Discovered

#43

Post by nickpsecurity »

Animats wrote: post #13

Now this is a case for sandboxing. A decompressor has one input file and one output directory. It should not have the power to change any state outside those files. A key point here is that not all code needs to be secure. Some code just needs to be kept in a box.

We're at the point where tools can automatically transform code for safety with OK penalties and some MAC implementations have about no penalties. Yet, still no use on the exact types of tools they're easiest to apply to. (Shakes head.)

Re: Multiple 7-Zip Vulnerabilities Discovered

#44

Post by nickpsecurity »

striking wrote: post #40
paulfr wrote: post #31

Earlier quoted context omitted.

Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to have an objective look at the current shortcomings in the state of 7-zip security, both in order to understand what needs to be done to fix it, and in order to warn current users until those issues are fixed. 7-zip is a widely popular basic…

I'm glad you care so much, but I don't think you can fix a culture issue by explaining it away. The best way to set a culture where there hasn't been one before, is to lead by example. Re: side note; the vulnerability described in the well-known Ken Thompson paper has been exploited just once in the wild. It's cool, but you could say the same thing about trusting Windows or proprietary drivers or hardware.

I counter the Thompson claim as vastly overstated risk when I see it here. I hadn't even heard that it was ever done before. Do you have a link or the project/time? I try to track these things.

Re: Multiple 7-Zip Vulnerabilities Discovered

#45

Post by TeMPOraL »

nwah1 wrote: post #25
poizan42 wrote: post #18

Earlier quoted context omitted.

> 7zip is not very well maintained, whereas PeaZip has regular releases. 16.00 2016-05-10 15.14 2015-12-31 15.12 2015-11-19 15.11 beta 2015-11-14 15.10 beta 2015-11-01 15.09 beta 2015-10-16 15.08 beta 2015-10-01 15.07 beta 2015-09-17 ... How is that not regular?

Perhaps lately. Prior to this past November, the stable release advertised on their site had been stuck on the same version for years, without even any point releases. And they use SourceForge for hosting. The code quality may be excellent, but it just seemed to me that they were not too well organized, logistically, compared to other projects.

Why would they need regular releases? This is not a web startup, it's an archive compression/decompression tool. It worked perfectly well 5 years ago.

Re: Multiple 7-Zip Vulnerabilities Discovered

#46

Post by dave2000 »

valarauca1 wrote: post #27
arkitaip wrote: post #14

Earlier quoted context omitted.

Not really sure why you would need regular releases for handing zip files, though.

Windows handles zip files horribly. The time to extract a 100MB zip in windows explorer is 4-6minutes (if not more). Compare this to ~30seconds in 7zip.

Windows ignores the partition you're unzipping to and writes to the c drive, then does a very slow, tedious move to the destination partition. It's obvious it should use the destination partition in the first place.

Re: Multiple 7-Zip Vulnerabilities Discovered

#47

Post by nickpsecurity »

de47 wrote: post #38
striking wrote: post #35

Earlier quoted context omitted.

Anyone's within their right to criticize an open source project. I think being "appalled" is a tad illogical, though. Similarly, does complaining about it on a public forum have any effect? In my book, code speaks louder than words; if you really want to see change, you know what to do.

Being appalled seems right to me. Under many circumstances, our actions come with a certain degree of responsibility. When we write code, we have the responsibility to be pretty open about security.

Where's the users' responsibility factor in to support the project financially or with code contributions? A gift given as is implies no responsibilities. A tool given for money should work as advertised. Yet, all this talk of responsibility appears on FOSS projects and is one way.

They have no responsibility to anyone. If you want responsibility, there's commercial offerings or you can sponsor 7-zip security for money.

Re: Multiple 7-Zip Vulnerabilities Discovered

#48

Post by dave2000 »

JetSetWilly wrote: post #30
striking wrote: post #24

Earlier quoted context omitted.

You can be appalled, but it's not like anyone's paying them for the work that they do. If you want to help them, I'm sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it's funny that you're so shocked that a popular free software project isn't perfect. Be the change you want to see. PS: who cares if the devs are using unsigned software d…

Every time an open source project is criticised, you get people saying "why are you criticising, you should do the work" - to the point that this seems to be a mechanism to shutdown any and all criticism of any open source project via special pleading. One can be very grateful for the work done on an open source project, and recognise that I have no right whatsoever to expect them to hop to it, but I am always free t…

It's not shutting down the criticism. Someone will always say that ("you can fix it blah blah blah") but you can just ignore it. Just don't expect anyone to put in extra hours fixing it to avoid that criticism because people who do open source work for fun in their spare time, and people who give a shit what random people they don't know say about them online are two entirely separate groups.

Re: Multiple 7-Zip Vulnerabilities Discovered

#49

Post by striking »

nickpsecurity wrote: post #44
striking wrote: post #40

Earlier quoted context omitted.

I'm glad you care so much, but I don't think you can fix a culture issue by explaining it away. The best way to set a culture where there hasn't been one before, is to lead by example. Re: side note; the vulnerability described in the well-known Ken Thompson paper has been exploited just once in the wild. It's cool, but you could say the same thing about trusting Windows or proprietary drivers or hardware.

I counter the Thompson claim as vastly overstated risk when I see it here. I hadn't even heard that it was ever done before. Do you have a link or the project/time? I try to track these things.

https://web.archive.org/web/20100305234633/http://www.h-onli...

Took some digging, but there it is.

Re: Multiple 7-Zip Vulnerabilities Discovered

#50

Post by striking »

eslaught wrote: post #36
striking wrote: post #24

Earlier quoted context omitted.

You can be appalled, but it's not like anyone's paying them for the work that they do. If you want to help them, I'm sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it's funny that you're so shocked that a popular free software project isn't perfect. Be the change you want to see. PS: who cares if the devs are using unsigned software d…

> PS: who cares if the devs are using unsigned software downloaded over HTTP? I care about using signed software (and then I suppose the transport doesn't really matter), but that's totally unrelated to what the devs do on their own computers. This is definitely a vector that attackers can and do use. If the developer is infected, particularly by a virus that changes the compiler to emit infected code, this can by pr…

See the note on my other comment: https://news.ycombinator.com/item?id=11686671
Post reply on HN