Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't know if this is better, but 7zips developer has an unnerving track record when it comes to security practices. He resisted adopting basic mitigations like DEP and ASLR for a long time, only relenting after a security researcher basically begged him to after finding arbitrary code execution exploits, and he still doesn't want to use any more advanced hardening techniques because they (slightly) bloat the binary size or have a (tiny) performance overhead.

I'm all for lean software but breaking ASLR by stripping the relocation tables, just to shave a few kilobytes off an executable which is primarily intended to parse untrusted files is just reckless.



PeaZip appears to rely on 7zip for most of its supported formats. So Peazip isn't really an alternative if you want to avoid 7zip out of security concerns.

> 7z ... should be placed in (peazip)/res/bin/7z, to manage 7Z files and most of the other supported formats

https://peazip.github.io/peazip-sources.html

I personally like libarchive and its bsdtar CLI, which also supports a wide range of formats. I don't know if there's any popular GUI frontend for it though.

https://libarchive.org


The native archive support that was recently added to Windows itself is backed by libarchive.


Doesn't streaming architecture of libarchive make it a poor choice for working with random access archives?


Can you please provide the source of this thread?



Thank you.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: