Information on the revocation of WinRAR 5.91 digital certificate
1–10 of 156 posts
Re: Information on the revocation of WinRAR 5.91 digital certificate
#2I would have incremented the version number so the likes of Chocolatey would pick it up and replace the version installed with a revoked certificate as part of a regular update.
Re: Information on the revocation of WinRAR 5.91 digital certificate
#3Do people still use WinRar? :O
Re: Information on the revocation of WinRAR 5.91 digital certificate
#4Do people still use WinRar? :O
Yes. People who don't know any better alternatives continue to use it, and continue to recommend it to other people. So the cycle continues.
Heck, WinZip still makes new releases so I'm sure people still use that too.
Re: Information on the revocation of WinRAR 5.91 digital certificate
#5I know the authorities need to err on the side of caution, but it's quite astonishing to me that someone at the authority didn't just say 'It's WinRAR...' and let it slide.
It's got to be one of the most well known tools in the entire windows ecosystem.
Re: Information on the revocation of WinRAR 5.91 digital certificate
#6I know the authorities need to err on the side of caution, but it's quite astonishing to me that someone at the authority didn't just say 'It's WinRAR...' and let it slide. It's got to be one of the most well known tools in the entire windows ecosystem.
If it were just the file not being clean on Virustotal I would fully agree. Heuristic detection will result in false positives. However, if they had an actual example of malware signed by that key that would indicate a compromise and that would justify pulling it. The absence of the offending file is suspicious, though.
Re: Information on the revocation of WinRAR 5.91 digital certificate
#7Do people still use WinRar? :O
Yes. People who don't know any better alternatives continue to use it, and continue to recommend it to other people. So the cycle continues. Heck, WinZip still makes new releases so I'm sure people still use that too.
> People who don't know any better alternatives continue to use it
Genuine question: what are the better alternatives?
Re: Information on the revocation of WinRAR 5.91 digital certificate
#8I know the authorities need to err on the side of caution, but it's quite astonishing to me that someone at the authority didn't just say 'It's WinRAR...' and let it slide. It's got to be one of the most well known tools in the entire windows ecosystem.
If it were just the file not being clean on Virustotal I would fully agree. Heuristic detection will result in false positives. However, if they had an actual example of malware signed by that key that would indicate a compromise and that would justify pulling it. The absence of the offending file is suspicious, though.
Yep, it would certainly justify pulling it, but quite bizarre that they're then refusing to issue another certification - I'm sure the WinRAR team would be able to prove they're the genuine developers.
Re: Information on the revocation of WinRAR 5.91 digital certificate
#9Earlier quoted context omitted.
Yes. People who don't know any better alternatives continue to use it, and continue to recommend it to other people. So the cycle continues. Heck, WinZip still makes new releases so I'm sure people still use that too.
> People who don't know any better alternatives continue to use it Genuine question: what are the better alternatives?
7zip
Re: Information on the revocation of WinRAR 5.91 digital certificate
#10Earlier quoted context omitted.
Yes. People who don't know any better alternatives continue to use it, and continue to recommend it to other people. So the cycle continues. Heck, WinZip still makes new releases so I'm sure people still use that too.
> People who don't know any better alternatives continue to use it Genuine question: what are the better alternatives?
Yep, +1 for 7zip