Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Information on the revocation of WinRAR 5.91 digital certificate

rarlab.com

Post reply on HN
Print view View original

31–40 of 156 posts

Re: Information on the revocation of WinRAR 5.91 digital certificate

#31

Post by izacus »

gruez wrote: post #18
xacky wrote: post #11

With both Windows and MacOS both putting scary warnings and hard to bypass blocking methods on improperly signed software this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate”. This is not the only incident like this.

>this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate” by whom? the platform makers (apple/microsoft) or malicious third parties?

Both. We've seen third parties do this on Windows and Apple themselves use this to punish developers who dared criticize them.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#32

Post by breakfastduck »

mrweasel wrote: post #13
Arnavion wrote: post #4

Earlier quoted context omitted.

Yes. People who don't know any better alternatives continue to use it, and continue to recommend it to other people. So the cycle continues. Heck, WinZip still makes new releases so I'm sure people still use that too.

Or maybe their customers just like the product, as in the GUI and feature and don’t care that another compression algorithm can shave off a few extra megabytes. If I recall correctly WinRAR can make self extracting archives pretty easily. If you use that feature it might be easier/better to just continue using WinRAR. I love the fact that small software companies like RARLAB can still exist.

It would be incredibly sad to see them go out of business, it's such an iconic piece of software.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#33

Post by asdfasgasdgasdg »

pimterry wrote: post #24

> We think that revoking certificates based on questionable data discredits the certification system. It's hard to dispute this imo. There are many good reasons certificates should be revoked, but the reasoning should be 100% public information, for both the vendor and users who may have trusted the original certificate. I'm building a desktop app, and the process to even get a certificate is absurd. Each CA has thei…

There's another aspect of this situation that also discredits the system: that they can just go out and get a different cert from another vendor. How many such vendors are there? How long would it take for an actual bad actor to have all their certs discovered and revoked? If that time is long, then the certification process is of even more dubious value, since the bad guys would not be materially hindered by the certification requirement.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#35

Post by vore »

WayToDoor wrote: post #22
theandrewbailey wrote: post #21

Earlier quoted context omitted.

Peazip: https://peazip.github.io/ I used to use 7zip, but switched when I discovered that Peazip doesn't extract to a temporary directory when extracting (thus, saving extra I/O work). It directly extracts into the target directory.

Is a file move that big of an IO operation?

I run into the issue sometimes cross-volume, where the file gets extracted into a temporary directory then has to be copied to the actual destination, into e.g. a network volume or second hard disk.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#36

Post by jasperry »

theandrewbailey wrote: post #21
AlexandrB wrote: post #7

Earlier quoted context omitted.

> People who don't know any better alternatives continue to use it Genuine question: what are the better alternatives?

Peazip: https://peazip.github.io/ I used to use 7zip, but switched when I discovered that Peazip doesn't extract to a temporary directory when extracting (thus, saving extra I/O work). It directly extracts into the target directory.

In response to WayToDoor, some archives contain thousands of files, and it's essentially doubling the number of filesystem operations by putting them in a temp directory and then moving. If the temp directory is on a different drive from the destination, then it's recopying all the data.

I thought the creation of the files in the temp directory was an unavoidable artifact of how drag-and-drop worked in Windows. If peazip can get around this, I might check it out.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#38

Post by theandrewbailey »

WayToDoor wrote: post #22
theandrewbailey wrote: post #21

Earlier quoted context omitted.

Peazip: https://peazip.github.io/ I used to use 7zip, but switched when I discovered that Peazip doesn't extract to a temporary directory when extracting (thus, saving extra I/O work). It directly extracts into the target directory.

Is a file move that big of an IO operation?

Back when I used Winzip/7zip, they didn't move files: they copied files. When you're working with files measured in gigabytes, the speedup is quite noticeable.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#39

Post by Santosh83 »

It is particularly ironic that so many people in this thread are recommending 7-zip in response to a cert problem with WinRAR when 7-zip has no code signing at all and presents the scary yellow "unknown software" screen when you try to install it.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#40

Post by iMerNibor »

WayToDoor wrote: post #22
theandrewbailey wrote: post #21

Earlier quoted context omitted.

Peazip: https://peazip.github.io/ I used to use 7zip, but switched when I discovered that Peazip doesn't extract to a temporary directory when extracting (thus, saving extra I/O work). It directly extracts into the target directory.

Is a file move that big of an IO operation?

If it's moving it to a different drive/partition it'll have to copy it again

Moving many (small) files can also be quite slow

Post reply on HN