WinRAR flaw lets hackers run programs when you open RAR archives

TheOneWithTheHair@lemmy.world to Technology@lemmy.world – 632 points –
bleepingcomputer.com
106

You are viewing a single comment

Well now I'm definitely not buying it.

I never understood the appeal of paid programs. 7-Zip works equally well and is free and open source software. It integrates much nicer into File Explorer as well.

I agree that 7zip is great (albeit based in Russia, so not something I'm sure I want to support at the moment), but consider for a moment that winrar licencing is primarily aimed at businesses (which is why they don't bother locking personal users out after the trial ends), and for that money you get a certain guarantee of functionality and stability over a long period of time.

There's absolutely no guarantees that 7zip will continue to be developed, or that it will retain it's current features and functionality - the developer can turn it into a Minesweeper clone if they feel like it, and there's nothing a business can do but keep using an outdated and thus potentially dangerous version that will eventually become unusable.

You also get a certain level of customer service and corporate communication between the purchasing company and the production company to help resolve issues, which may not exist at all with the alternative.

It's also not always wise to have your business rely heavily on a tool that only sees development through volunteer work by a limited number of disparate people that may come and go, and while I don't know how large the volunteer base is that works on 7zip (it could be just the one guy, it could be a hundred people), to a company it'll never feel as reliable an option as relying on a tool that sees development and maintenance through a paid, full time staff at an established legal entity company with an established reputation.

And speaking for a moment to that established company bit, consider that winrar's company is based in Berlin, within the European Union and under it's rules and laws, which is a far better proposition from a company's standpoint than having to legally deal with an individual guy inside the Russian Federation, especially one that hasn't actually sold your business a product at all.

Anyway, just a few potential thoughts for why tools that do the same job might be preferred by a business, sorry it got a bit long 😅

I mean, does paying for winrar somehow guarantee that it will keep being actively developed?

No, the fact that businesses pay for it for something of that guarantee despite there being free peer-alternatives means that it is a better guarantee.

When you see businesses electing to pay for something despite free alternatives, there is likely a reason (or a number of them). I've seen free tools go from active maintaining to completely dead in a single update due to the work needed to get it back up and operating with new environment-side changes.

I've seen free tools go from active maintaining to completely dead in a single update

And we've all seen companies go out of business overnight. There's no more guarantee that WinRAR will still be around tomorrow than there is for 7z.

1 more...
1 more...

7zip is FOSS, GPL license. Even if the author stops others can step in. Even if nobody does and it stops being actively developed you'll still be able to extract your archives for the foreseeable future. You can still unpack ARC files from the 80s.

Yep, I run a number of Linux distros. Debian to Arch. They all handle 7z with no fuss.

Just because someone was born in Russia does not make them a specific type of person. Nobody chooses where or when they are born. 7-Zip has been for ages, and if something were to happen to it then im sure one of the dozen of forks around will take the role as the "main one". However you are right, companies desire something predictable, stable. Which is why some companies like SUSE, Red Hat, etc. Manage to sell FOSS. in fact i believe some of these distros include p7zip, and they freeze it to a specific version, security updates and bug fixes are backported.

However, WinRAR in this case is also the one that puts your business at risk.

9 more...

I like WinRAR for its built-in parity functionality. You can achieve similar results with 7-Zip using PAR2, but having it built right into WinRAR with two options (add a recovery record to each archive, or create separate recovery archives (basically what PAR2 does)) is so much more convenient.

WinRAR is like what..? 30-35 bucks? That's per user, unlimited machines, lifetime license. More than fair I'd say.

WinRAR has so much better UI than 7zip.

I will honestly move away from WinRAR if something better with dark theme is launched.

2 more...

Microsoft basically copied WinRAR added it to the OS, back in the windows 7 days you needed WinRAR

Implementing support for a widely used format isn’t “basically copied” and there have been alternatives for decades.

Back in the Windows 7 days you could use 7zip. I've been using it since like XP

WinRar decompresses directly to destination. All other I have tried does it to like c:/tmp (can probably change that though) then copy it over, which is impractical or even impossible with really large files.

That's about it though IMO.

You can decompress directly to the destination with 7zip as well. You just need to use the "extract" button instead of doing a drag and drop.

Cool thanks for the info, I did it by script but then trere is maybe some option I didn't find...

1 more...
4 more...
15 more...

does it still let you infinitely have a free trial??

Just blow the dust off that copy of serials2k 🤣

15 more...