I'm not excusing the bug, but 7-zip had been one of the first tools I install on any windows installation since XP, setting it as default application to handle all archive formats it supports, .zip included. I'm surprised to see so many comments about potentially running into this bug, doesn't everyone just use 7-zip?
7-zip is okay on the format side since they added some of the newer high-efficiency compression algos, but the UI still sucks compared to WinRAR.
I take it you're doing more than is offered in the right-click menu?
I like to use a good UI for that stuff when I'm on a graphical system like Windows anyway, and WinRAR is consistently better at that than 7-Zip.
I even seriously miss WinRAR when working on MacOS. Does anybody have any good suggestions for archive managers (may also be expensive ones, I don't care much if they are really good) with similar UI and functionality as WinRAR on MacOS?
source: https://borncity.com/win/2018/02/21/security-risk-avoid-7-zi...
The same can be said for every Windows software. Heck, even Windows itself. Although it offers you the option to install updates before exposing your computer to any security risks, I doubt many people are patient enough to take it.
1. 7zip has had security flaws - so does every other software that interacts with untrusted data, and the author admits himself that 7zip's author has responded quickly (it doesn't seem like 7zip has an abnormally high amount of exploits)
2. People are using/redistributing old versions of 7zip which are vulnerable - and that's 7zip's fault how? 7zip's own website has an easy to use and up to date installer, go after the people hosting the shitty mirrors
3. 7zip doesn't use ASLR - the author of the article literally gives the reason for this: shrinking the binary size (he then tries to pretend like this is some gaping security flaw)
4. 7zip doesn't use DEP on 32 bit windows prior to win10 - do people seriously even use 32 bit windows nowadays? (also, this is as dumb of a "flaw" as not having ASLR)
Fun fact: the article's author recommends you use the OS's built in tools (aka windows explorer), so I guess I'll just have to pretend that any tar/rar/etc files don't exist
ASLR makes it harder to exploit other bugs that might exist in the software. Browser for example should definitively use it, since they are highly complex systems while also your first line of defense against a somewhat competent attacker. As for 7zip... it also can come in contact with dubious files quite easily while also having to support lots of formats (huge attack surface with potential bugs). I'm torn, but would probably prefer it to use ASLR.