https://www.bleepingcomputer.com/news/security/winrar-flaw-lets-hackers-run-programs-when-you-open-rar-archives/
A high-severity vulnerability has been fixed in WinRAR, the popular file archiver utility for Windows used by millions, that can execute commands on a computer simply by opening an archive.
I never understood the appeal of paid programs. 7-Zip works equally well and is free and open source software. It integrates much nicer into File Explorer as well.
I agree that 7zip is great (albeit based in Russia, so not something I'm sure I want to support at the moment), but consider for a moment that winrar licencing is primarily aimed at businesses (which is why they don't bother locking personal users out after the trial ends), and for that money you get a certain guarantee of functionality and stability over a long period of time.
There's absolutely no guarantees that 7zip will continue to be developed, or that it will retain it's current features and functionality - the developer can turn it into a Minesweeper clone if they feel like it, and there's nothing a business can do but keep using an outdated and thus potentially dangerous version that will eventually become unusable.
You also get a certain level of customer service and corporate communication between the purchasing company and the production company to help resolve issues, which may not exist at all with the alternative.
It's also not always wise to have your business rely heavily on a tool that only sees development through volunteer work by a limited number of disparate people that may come and go, and while I don't know how large the volunteer base is that works on 7zip (it could be just the one guy, it could be a hundred people), to a company it'll never feel as reliable an option as relying on a tool that sees development and maintenance through a paid, full time staff at an established legal entity company with an established reputation.
And speaking for a moment to that established company bit, consider that winrar's company is based in Berlin, within the European Union and under it's rules and laws, which is a far better proposition from a company's standpoint than having to legally deal with an individual guy inside the Russian Federation, especially one that hasn't actually sold your business a product at all.
Anyway, just a few potential thoughts for why tools that do the same job might be preferred by a business, sorry it got a bit long 😅
No, the fact that businesses pay for it for something of that guarantee despite there being free peer-alternatives means that it is a better guarantee.
When you see businesses electing to pay for something despite free alternatives, there is likely a reason (or a number of them). I've seen free tools go from active maintaining to completely dead in a single update due to the work needed to get it back up and operating with new environment-side changes.
I've seen free tools go from active maintaining to completely dead in a single update
And we've all seen companies go out of business overnight. There's no more guarantee that WinRAR will still be around tomorrow than there is for 7z.
7zip is FOSS, GPL license. Even if the author stops others can step in. Even if nobody does and it stops being actively developed you'll still be able to extract your archives for the foreseeable future. You can still unpack ARC files from the 80s.
Just because someone was born in Russia does not make them a specific type of person. Nobody chooses where or when they are born. 7-Zip has been for ages, and if something were to happen to it then im sure one of the dozen of forks around will take the role as the "main one". However you are right, companies desire something predictable, stable. Which is why some companies like SUSE, Red Hat, etc. Manage to sell FOSS. in fact i believe some of these distros include p7zip, and they freeze it to a specific version, security updates and bug fixes are backported.
No, it isn't! Especially if you want to edit files inside a .zip, which that tool doesn't seem capable to do it, nor creating multiple individual files... Also, if you just want to browse a package to see what it's inside, the GUI does a piss poor job showing you the files/folders.
… You can’t edit files inside a zip file. The program’s just hiding that it’s decompressing and decompressing the whole thing every time you change something.
Zip files are usually just another wrapper around DEFLATE, and compressing each block requires knowledge of the previous block’s compression (Part of LZ77). It’s a streaming format, not a sparse format.
I’ve updated packages of RAR files in the past, by adding new files into the container itself ¯\_(ツ)_/¯
If you edit a text file, it actually just creates a new file because inserting text in the middle means all of the text after changes position. I'd still call that editing an existing file rather than creating a new file based on the previous one plus some edits. The second description might be more technically accurate but it's just unnecessary technical details because it's effectively the first description.
Even going back to the original use of edit, editors would mark up books or articles and then a new copy would need to be created with those edits. I'm having trouble thinking of any cases where edit truly means "change something in place without making a new copy of it with the changes included". I guess small edits with pencil or whiteout can sometimes work.
I like WinRAR for its built-in parity functionality. You can achieve similar results with 7-Zip using PAR2, but having it built right into WinRAR with two options (add a recovery record to each archive, or create separate recovery archives (basically what PAR2 does)) is so much more convenient.
WinRAR is like what..? 30-35 bucks? That's per user, unlimited machines, lifetime license. More than fair I'd say.
WinRAR has so much better UI than 7zip.
I will honestly move away from WinRAR if something better with dark theme is launched.
PeaZip is algo very good and has dark mode. I still prefer 7zip on Windows, but on MacOS is my elected choice.
I have tried PeaZip Multiple times and have always turned away. It has significant startup & load time compared to WinRAR.
Microsoft basically copied WinRAR added it to the OS, back in the windows 7 days you needed WinRAR
Implementing support for a widely used format isn’t “basically copied” and there have been alternatives for decades.
WinRar decompresses directly to destination. All other I have tried does it to like c:/tmp (can probably change that though) then copy it over, which is impractical or even impossible with really large files.
That's about it though IMO.
You can decompress directly to the destination with 7zip as well. You just need to use the "extract" button instead of doing a drag and drop.
This is the right answer! Since I never used drag and drop I wasn't ever aware that this was an issue.
According to the FAQ:
Why does drag-and-drop archive extraction from 7-Zip to Explorer use temp files?
7-Zip doesn't know folder path of drop target. Only Windows Explorer knows exact drop target. And Windows Explorer needs files (drag >source) as decompressed files on disk. So 7-Zip extracts files from archive to temp folder and then 7-Zip notifies Windows Explorer about >paths of these temp files. Then Windows Explorer copies these files to drop target folder.
To avoid temp file usage, you can use Extract command of 7-Zip or drag-and-drop from 7-Zip to 7-Zip.
Cool thanks for the info, I did it by script but then trere is maybe some option I didn't find...
You sure about that? I’ve decompressed huge files, some time ago, using a 3.5” HDD and if it were like that, it would take much longer than needed because of that overlay you talk about.
And it took the same time as WinRar (͡•_ ͡• )
Downvote all you want, but you can configure WinRAR to decompress directly to source.
I had TB files and just no space to have both a copy and the result, IIRC the speed was also obviously better without copying.
I didn’t downvoted your post, I just made a genuine question, since I’ve never noticed that.
I’m just sceptic on what you mentioned. Whenever I have some free time, I’ll try to do a deep test on that one!
Edit: No need to do a test, since I never use drag n drop (like mentioned on another comment), my test would always show the same outcome as WinRAR.
if you’re on Windows use NanaZip. 7Zip refuses to use modern compression and encryption algorithms or integrate with the new Windows APIs. NanaZip is a fork that does just that.
7-zip doesn’t exist on Linux. p7zip does, which hasn’t been updated since 2016
EDIT: It does, I stand corrected
7zip does exist on Linux:
https://www.7-zip.org/download.html
p7zip itself is out of date but updated forks exist. With 7zip having an up to date official version though there's no point to it.
Lol, just noticed that not only it is already installed on my system (never used it), but it also comes with a benchmark built in.
P7zip? Is this some kind of single-thread thing I'm too multi-threaded to understand?
p7zip does, which hasn’t been updated since 2016
Where there security holes since then?
Of course! 7-zip is absolutely a software cornerstone, but as in all things open source it’s now better as it’s forked version with more active community efforts taking place
Latest release is a touch old (2022) and it's not the most active repo ever. Hopefully its not dying.
I bought mine and own it happily - us licence holders should all get together, we could probably fill up a Chuck-E-Cheese
Somehow Windows has always been and is still crap at managing archives. Ultra-slow, has trouble opening or extracting individual files inside the archive, etc.
However, 7-zip has been doing all that perfectly forever now. Not sure why anyone would use WinRAR, paid for or not.
Even 7Zip now though is insecure and outdated. Use NanaZip if you’re on windows, it's a fork that is more secure and uses modern compression/encryption algorithms in addition to integrating better with current Windows APIs
Yeah maybe isn't great but I admit that be able to use the open file window from a program and select a file inside a compressed file is nice.
WinRAR is an internet institution at this point. It’s like Amtrak, why would anyone ride the train when there are better cheaper and faster modes of transport? Don’t know but people do anyway
What? Amtrak is great for specific use cases. For intrastate travel in the US, Amtrak often is the fastest, cheapest, most comfortable experience.
Oddly, going two states over, it's often the slowest and most expensive, but for mid haul distance, Amtrak is fantastic.
That’s kind of my point that WinRAR has its limited use cases like Amtrak does although majority of the time it’s more efficient to use something else
However, from a practical perspective, deceiving users into performing the required action shouldn't be overly challenging, and given the vast size of WinRAR's user base
Excuse me, but "vast" size of WinRAR's user base? I didn't know WinRAR even had any users left.
9 out of 10 people I know use WinRAR. It's amongst the very firsr software they install at fresh start.
I myself also just changed to 7-Zip around... I don't know, a year ago?
Which part of the world is this, if you don't mind me asking? (just genuinely curious, cause I haven't come across any WinRARs in the wild here in NZ, most folks I know use either 7-Zip or PeaZip).
I'm from Europe, in the embrace of the Carpathian Mountains :)
before WinRAR, people used WinZIP here in the '00s (at least Windows folks). Again, a strange choice, I know.
Am in the US and used winrar for a long time as it was integrated into Usenet binaries as rar files. It was embedded with some other software.
WinRAR was what I used in the 2000s. Around 2011, 7-zip was my goto. I haven't looked back since.
I wasn't aware of pea-zip until this thread
Here is an alternative Piped link(s): https://piped.video/lX_pF03vCSU
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source, check me out at GitHub.
Well, even FAR manager which they've open-souced long time ago is still maintained 😀 Good thing they didn't discover this bug in 2000s!
That looks quite interesting, seems like they've even got quite an extensive list of plugins - looks like may be even better than Midnight Commander. :o
Ah, FAR manager.
I used it last time around... 15 years ago to apply VKP patches on my Sony Ericsson phones :P like making my K750i into a 'W750i' with W800i software, adding GFX and Acoustic patches...
On a very very rare occasion I've had to use it for scene cracks as other apps didn't work. They use WinRAR to archive it so on those very rare occasions it's the only thing that unpacks it
I bought a lifetime license literally more than 20 years ago to support the developer. I use 7Zip for most stuff but prefer WinRAR for split rar archive support.
That's, quite ironically, a pretty ignorant opinion. There are areas where WinRAR is stronger than 7zip.
The person you replied to never mentioned 7-Zip, and there's forks and other programs that are probably just as strong in the same areas.
"probably"
The commenter implied that there's a tool which is better than WinRAR in everything and therefore there can't possibly be a reason to use WinRAR. Which application is it then?
I'd need to know the areas you consider 7-Zip to be stronger in first, because I can't think of anything myself.
As an example, RAR provides parity records which allows recovery of large amounts of compressed data in case of data corruption. 7zip can lose all its content if one bit is flipped.
RAR provides much more support for underlying file system support which makes it more suitable as an archival tool. Things like NTFS hard links, streams, ACLs, all three timestamps. 7zip doesn't support that.
WinRAR in general has way more niche features for advanced use cases, while 7zip focuses on the basics.
They are basically a vitamined frontend + custom backend for 7zip-zstd supporting several other formats such as lzip.
Thanks! I've been happy with 7-Zip for Windows, but what you're describing sound like an upgrade with few downsides, if any. I'll try it next time I get the chance!
That version is not official. Was a rework made by an external user.
I remember the main author was trying to rework their custom version but yes, no GUI.
Well these benchmarks might seem a bit biased, since they are made by the dev, but I took the time to read them, and they seem very neutral and unbiased.
It support zip, rar, 7z. Basically all archive formats. It has way better UI. It is open source. It is free in beer.
It is open source. It is free in beer.
It is free as in speech. Your phrase refers to proprietary yet no cost software.
This!
I used winrar at first, but never truly trusted 7zip. Didn't like the way it looked. Then first time I learned about ninite, I saw peazip and never looked back.
With the soon to be supported .rar on windows 11 I might do away with it but I feel peazip works faster.
