61–70 of 72 posts
I always found it strange that 7-zip appears to be developed by a single individual, despite being very popular. I know the fact that this lone developer apparently resides in Russia has caused 7-zip to be outright banned in certain places.
That's a particularly ignorant approach, especially considering the whole thing is open-source and auditable.
Earlier quoted context omitted.
Perhaps lately. Prior to this past November, the stable release advertised on their site had been stuck on the same version for years, without even any point releases. And they use SourceForge for hosting. The code quality may be excellent, but it just seemed to me that they were not too well organized, logistically, compared to other projects.
Why would they need regular releases? This is not a web startup, it's an archive compression/decompression tool. It worked perfectly well 5 years ago.
Earlier quoted context omitted.
Can you give me pointers about authenticode flaws? After a quick search the two issues I found were with MD5 collisions (solution: the signer should never emit MD5 certificates) and certificate padding (solution: the user should set a registry key to enable verification of padding; search for "EnableCertPaddingCheck").
Here's a good pres: https://recon.cx/2012/schedule/attachments/54_Signed_executa...
Earlier quoted context omitted.
Here's a good pres: https://recon.cx/2012/schedule/attachments/54_Signed_executa...
Their conclusion is simply that "the major part has been fixed" in MS12-024, and that you should be careful if you write a self-extracting installer. No big deal.
Here's one example: https://virustotal.com/en/file/fe8fa4daa404ebb3bd6df4c20650a...
All of them are self-extracting installers (happen to be 7zip/Nullsoft). That successfully fake sigs. Nullsoft is the most popular packer/extractor out there.
Sure, there are ways of creating an installer with authenticode that cannot be faked, but much easier to just hash it and not worry about the terrible tech that is authenticode.
Edit: That's a fake Firefox installer with authenticode that checks out according to the spec. As you can see, this is not some weird edge case.
Earlier quoted context omitted.
7-zips track record of lack of vulnerabilities [1] would imply something entirely different to me. Only 2 CVEs ( and now this ) in a heck of a long time. 7z being used in quite a variety of places it seems like a lucrative attack vector, so I would expect that ample amount of fuzzing and other techniques has gone into trying to break it over the years. Which obviously doesn't mean, as these findings highlight, that i…
Just because you don't see a CVE doesn't mean there aren't major flaws. It just means the researcher didn't want to bother with getting a CVE.
https://www.cvedetails.com/vulnerability-list/vendor_id-787/... https://www.cvedetails.com/vulnerability-list/vendor_id-787/... https://www.cvedetails.com/vulnerability-list/vendor_id-72/p... https://www.cvedetails.com/vulnerability-list/vendor_id-816/... https://www.cvedetails.com/vulnerability-list/vendor_id-1198...
I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it…
You can be appalled, but it's not like anyone's paying them for the work that they do. If you want to help them, I'm sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it's funny that you're so shocked that a popular free software project isn't perfect. Be the change you want to see. PS: who cares if the devs are using unsigned software d…
Rather than being seen as attacks on a project, these sorts of comments are often just highlighting some things that whoever is looking at that particular project might want to fix.
The "don't criticise unless you're prepared to fix it" attitude is very similar to the sort of "Don't bring me problems, just solutions" attitude that some managers have that results in a culture of people keeping quiet about stuff they've spotted but don't have either the time or ability to fix themselves.
I always found it strange that 7-zip appears to be developed by a single individual, despite being very popular. I know the fact that this lone developer apparently resides in Russia has caused 7-zip to be outright banned in certain places.
> I know the fact that this lone developer apparently resides in Russia has caused 7-zip to be outright banned in certain places. That's a particularly ignorant approach, especially considering the whole thing is open-source and auditable.
That's my tax dollars at work. :)
I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it…
Earlier quoted context omitted.
Why would they need regular releases? This is not a web startup, it's an archive compression/decompression tool. It worked perfectly well 5 years ago.
I was wondering the same. Unless it involves a security being ignored for a year or more, I don't see much of an issue with a lack of updates. I rather a developer takes their time to write their code vs. speed coding and publishing new bugs left and right.
The Linux Kernel, Firefox, and lots of projects have some sort of Long Term Service branch where simple uncontroversial improvements are added.
Modern best practices for releasing open source software are important, and a project that doesn't seem aware of any of them makes me concerned about their attention to detail.