Earlier quoted context omitted.
My experience so far (helped maintain lots of non IT people's computers) was also, that the performance gain from removing antivirus software (and just using defender) was worth the theoretically less protection.( If even so) Besides, with the behavior of most free Antivirus I could not really distinguish from common spyware. Everything needs to call home these days ... So when friends ask me if this computer is now…
Many of my customers run the common free anti-virus programs and I can assure you that they are not snake oil. The logs and alerts from blocked infection attempts are testament to this. I certainly would say that most of the free anti-virus is pushy, hungry and generally not a particularly great marketing exercise.
7-Zip: Multiple Memory Corruptions via RAR and ZIP
51–60 of 106 posts
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#52Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated.
It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is because it is lightweight no-bullshit software that does its job and otherwise stays out of the way. We could stand to do with some more of that in 2018.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#53Earlier quoted context omitted.
Many of my customers run the common free anti-virus programs and I can assure you that they are not snake oil. The logs and alerts from blocked infection attempts are testament to this. I certainly would say that most of the free anti-virus is pushy, hungry and generally not a particularly great marketing exercise.
> The logs and alerts from blocked infection attempts are testament to this. Infection attempts by what? Scans of phishing mail attachments they wouldn't have opened anyway? At least if they know what they are doing. In addition, many AV have this annoying habit of reporting quite a bit of false-positives based on sys-calls or some weird heuristics, this leads to the situation where even totally legit software, from…
> Infection attempts by what?
In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick.
These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like.
I don't think that in any of the cases the user would have had a warning to blindly click through.
Not entirely sure how an advert blocker can stop email or device-carrying malware.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#54Earlier quoted context omitted.
PeaZip is pretty good and is FOSS
> PeaZip is free file archiver utility, based on Open Source technologies of 7-Zip, p7zip, FreeArc, PAQ, and PEA projects. It seems to use 7-Zip and/or p7zip binaries.
p7zip was also patched. 18.00 doesn't have the bug, but it looks like Peazip hasn't been updated with it.
I'm not sure what other FOSS alternative to use. BandiZip is free (as in beer) but doesn't seem to have an update since Sept, so if it uses p7zip under the hood for 7z, it's also vulnerable.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#55Earlier quoted context omitted.
"because 99% of AV break Windows/applications" This statement does not at all pan out in my experience. It is very rare for me to come across broken applications or a faulty Windows installation because of anti-virus software.
Your experience seems very limited. Be a MSP with thousands or tens of thousands of different configurations, all the different antivirus software you can think of, and 20+ years of doing it and you'll see anti-virus break everything you can think of. AV prevents windows from shutting down. AV prevents windows from booting up. AV prevents windows upgrades. AV prevents windows updates. AV causes blue screens. AV quara…
I'd suggest you don't know what experience I have.
I've certainly had problems with anti-virus programs, but no more than I have had with any program, operating system, driver or hardware problem really. Mostly they behave, sometimes they misbehave.
I've rarely seen anti-virus causing shutdown problems. Boot problems have almost always been faulty storage devices or operating system corruption. I've fixed more faulty WU instances that are broken because of Microsoft (recent Win7 authcab problem, IE cumulative years ago, etc). than because of anti-virus. The programs that I have come across that are crashing are rarely solved by removing anti-virus software.
If anti-virus was as widely and horrendously crap as some people keep repeating then I'd know about it because I'd be saying the same thing.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#56Earlier quoted context omitted.
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is…
Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that.
These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#57Earlier quoted context omitted.
It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").
I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…
Yeah, anti-virus is a crap idea.
Real security is proactive security (exploit mitigation, sandboxing, correct code, safe languages).
Reactive security kinda sucks. You have to patch known vulnerabilities, sure, but detecting exploits? Ugh. Eww. Do not like.
And indeed users mostly install malware these days, because self spreading (actual "viruses") is hard (we're not in the DOS/Win9x days anymore). So users should be proactive as in not clicking on TotallyNotMalware.exe :)
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#58Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore v…
> The way the stylesheet makes the "rendered" form (especially section headings) resemble markdown source is pretty neat.
As far as I see it's just section headers, but I agree the stylesheet is very nice. The section header prefix (###) could be an anchor to the section though ().
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#59Earlier quoted context omitted.
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is…
Please stop with the hyperbolic strawman. None of "https, sign his binaries, or enable mark-of-web" are "latest performance killing mitigation strategies". Nobody is arguing with 7z's success, either. I don't know where you're sensing that. These are just reasonable (or even necessary) techniques to ensure the security of the product you're shipping. We ought to know better.
So, how is HTTPS related to the binary size?
Arguably, you both bullshited, but his was more on topic.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#60Earlier quoted context omitted.
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is…
> He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated.
This attitude is much of the reason why software security is as bad as it is today. I'll take a little "bloat" over ZIP files being able to install ransomware (and security vs. performance doesn't have to be a tradeoff anyway).