31–40 of 104 posts
7zip.com has never been the official website of the project. It's been 7-zip.org
How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?
Earlier quoted context omitted.
How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?
> How can the average 7zip user know which one it is? I dunno, if you type "download 7zip" into Google, the top result is the official website. Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website. This is actually a pretty good case of the regular user being pretty safe from downloading malware.
Are the search removals and phishing warnings reactive or proactive? Because if it is the former then we don't really know how many users are already affected before security researchers got notified and took action.
Also, 7zip is not the only software to be affected by similar domain squatting "attacks." If you search for PuTTY, the unofficial putty.org website will be very high on the list (top place when I googled "download putty.") While it is not serving malware, yet, the fact that the more legitimate sounding domain is not controlled by the original author does leave the door open for future attacks.
7zip.com has never been the official website of the project. It's been 7-zip.org
How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?
2. Go the listed homepage
Earlier quoted context omitted.
The same could be said for software from the US. Could be a vector of CIA. For average US citizens, it might even be safer to use Russian software because FSB can't come after them.
Funny thing that it's exactly the same for Russian citizens - they'd rather use US government malware. Same goes for mail providers.
Earlier quoted context omitted.
How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?
There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.
Does the 7-Zip author still refuse to digitally sign or even provide hashes of the official downloads? It's an extremely weird flex, he thinks it's a frivolous waste of time or something.
I migrated from 7-Zip to NanaZip, a fork with modern Windows features that the original developer refuses to implement. https://github.com/M2Team/NanaZip
I imagine an electron rewrite, with DirectX 12 and Copilot buttons everywhere
Does the 7-Zip author still refuse to digitally sign or even provide hashes of the official downloads? It's an extremely weird flex, he thinks it's a frivolous waste of time or something.
Do people even double check installers are digitally signed? There's so much open source stuff out there that is not digitally signed, most people might not even notice.
Earlier quoted context omitted.
Funny thing that it's exactly the same for Russian citizens - they'd rather use US government malware. Same goes for mail providers.
It is not a bad rule, to use online services / software where you know that the malicious owners are likely not after you nor in cahoots with the government where you live. Or you can take the Swiss option with stuff like ProtonVPN, Signal etc. :-)
7zip.com has never been the official website of the project. It's been 7-zip.org
How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?