🆕 Software Suggestion | 7-ZIP as honourable mention for file encryption #867

New Issue

2019-04-16T13:03:27Z

ghost commented

2019-04-16 13:03:27 +00:00

(Migrated from github.com)

REMOVED

👍 4

five-c-d commented

2019-04-16 20:09:12 +00:00

(Migrated from github.com)

yet also uses the 7-ZIP archive format

My understanding is that PeaZip (which is in FreePascal) actually includes the 7zip binary (which is in CPP and tuned for speed) as part of the app. So in some sense, if you install PeaZip you are also installing 7z proper simultaneously.

There are a few differences according to wikipedia, the main one being that 7zip GUI works on OSX already (PeaZip is still listed as being 'TBD' for macOS support). PeaZip supports several file-formats that 7zip alone does not: arc/freeArc, zpaq/lpaq/paq, quad/balz, pea-format, and can read .ace as well. 7zip supports reading linux deb/rpm/cpio, apple dmg, windows msi, and has beta support for xz (read&write). Presumably you can get those same things via the PeaZip wrapper around 7zip, I'm guessing. PeaZip also has some kind of archive-repair-tool thing, not sure if it is useful/helpful versus dedicated apps.

My recommendation would be to just mention (inside the PeaZip blurb) briefly that 7zip is wrapped by PeaZip, and that it has CLI support for some oddball platforms where PeaZip may not be supported (FreeDOS + AmigaOSv4 + reactOS + openVMS), in case anybody cares ... and link to the wikipedia page so folks can read the gory details if they wish.

> yet also uses the 7-ZIP archive format My understanding is that PeaZip (which is in FreePascal) actually includes the 7zip *binary* (which is in CPP and tuned for speed) as part of the app. So in some sense, if you install PeaZip you are also installing 7z proper simultaneously. There are a few differences <a href="https://en.wikipedia.org/wiki/Comparison_of_file_archivers">according to wikipedia</a>, the main one being that 7zip GUI works on OSX already (PeaZip is still listed as being 'TBD' for macOS support). PeaZip supports several file-formats that 7zip alone does not: arc/freeArc, zpaq/lpaq/paq, quad/balz, pea-format, and can read .ace as well. 7zip supports reading linux deb/rpm/cpio, apple dmg, windows msi, and has beta support for xz (read&write). Presumably you can get those same things via the PeaZip wrapper around 7zip, I'm guessing. PeaZip also has some kind of archive-repair-tool thing, not sure if it is useful/helpful versus dedicated apps. My recommendation would be to just mention (inside the PeaZip blurb) briefly that 7zip is wrapped by PeaZip, and that it has CLI support for some oddball platforms where PeaZip may not be supported (FreeDOS + AmigaOSv4 + reactOS + openVMS), in case anybody cares ... and link to the wikipedia page so folks can read the gory details if they wish.

ghost commented

2019-04-16 21:02:43 +00:00

(Migrated from github.com)

REMOVED

jonah commented

2019-04-17 00:50:27 +00:00

Uh well let's keep this open until changes are actually made...

👍 1

five-c-d commented

2019-04-17 07:14:06 +00:00

(Migrated from github.com)

@JonahAragon , are you saying that Ryan or myself or somebody should submit a pull-request, to implement the suggested rewrite of the PeaZip blurb? Or are you saying, hold-your-horses and there needs to be further discussion of what the best approach is?

To be clear, I'm happy to see 7zip added on the list, it is what I use, since the previous millenium even ;-) My guess is that PeaZip was chosen instead, because it bundles 7zip and you get two for the price of one-download-and-install-effort. Or possibly the PeaZip GUI is more beginner-friendly?

But to me the main differentiator -- as determinative of whether to list 7zip as a different option versus whether to mention it briefly within the PeaZip blurb -- is going to be whether PeaZip works on OSX or just refuses to install at all. Anybody with MacOS on a device or three, who can compare the user experience of 7zip-standalone versus PeaZip-with-7zip-embedded?

@JonahAragon , are you saying that Ryan or myself or somebody should submit a pull-request, to implement the suggested rewrite of the PeaZip blurb? Or are you saying, hold-your-horses and there needs to be further discussion of what the best approach is? To be clear, I'm happy to see 7zip added on the list, it is what I use, since the previous millenium even ;-) My guess is that PeaZip was chosen instead, because it bundles 7zip and you get two for the price of one-download-and-install-effort. Or possibly the PeaZip GUI is more beginner-friendly? But to me the main differentiator -- as determinative of whether to list 7zip as a different option versus whether to mention it briefly within the PeaZip blurb -- is going to be whether PeaZip works on OSX or just refuses to install at all. Anybody with MacOS on a device or three, who can compare the user experience of 7zip-standalone versus PeaZip-with-7zip-embedded?

beerisgood commented

2019-04-17 08:09:06 +00:00

(Migrated from github.com)

I don't see any reason why PeaZip is better. In fact it need to wait for 7zip Update and even then, is slower.
Important for security updates.

So I wouldn't recommend it and recommend only the original 7Zip

I don't see any reason why PeaZip is better. In fact it need to wait for 7zip Update and even then, is slower. Important for security updates. So I wouldn't recommend it and recommend only the original 7Zip

jonah commented

2019-04-17 13:57:55 +00:00

are you saying that Ryan or myself or somebody should submit a pull-request, to implement the suggested rewrite of the PeaZip blurb? Or are you saying, hold-your-horses and there needs to be further discussion of what the best approach is?

I'm not saying anything about the change itself. I'm just saying if the author wants the website changed, this issue needs to remain open until it is changed (or we decide to not make changes), otherwise people will forget about it 😄

> are you saying that Ryan or myself or somebody should submit a pull-request, to implement the suggested rewrite of the PeaZip blurb? Or are you saying, hold-your-horses and there needs to be further discussion of what the best approach is? I'm not saying anything about the change itself. I'm just saying if the author wants the website changed, this issue needs to remain open until it *is* changed (or we decide to not make changes), otherwise people will forget about it 😄

ghost commented

2019-04-17 14:31:40 +00:00

(Migrated from github.com)

REMOVED

blacklight447 commented

2019-06-02 07:01:50 +00:00

(Migrated from github.com)

As the original post and poster is gone, is this issue to be closed, or will we continue without him? @jonah

Mikaela commented

2019-06-02 08:53:10 +00:00

(Migrated from github.com)

I think if someone wants to see this, they will open a new issue.

five-c-d commented

2019-06-02 12:00:09 +00:00

(Migrated from github.com)

As the original post and poster is gone

The username is gone, yes, but the posts themselves, are still available. For example on this comment, https://github.com/privacytoolsIO/privacytools.io/issues/867#issuecomment-484115198 you can click the "edited by ghost" thing in the comment-header, and see what they said prior to editing the text to say 'REMOVED'. You can see the OP info, the same way

open a new issue

I might do that ;-) But since I've already saved a github draft of my reply, I'll go ahead and comment here one last time.

it need to wait for 7zip Update

Have you looked into what version of 7zip is included with PeaZip, and about how long it takes before PeaZip gets the latest stable version of 7zip, included in their bundle?

and even then, is slower

@beerisgood ...you mean, slower in performance, because of the Pascal-based GUI calling out to the CPP-based executable? Is it really slower in any human-perceptible way?

Or you mean, "slower" aka the lag time until the bundled 7zip is upgraded to match the upstream, per my question above about security-patch promptness? While I agree that there are some security issues in zipfile-apps, but they tend to be rare and infrequent. Plus exploiting them is difficult... the adversary has to send you a zipfile, containing an exploit, and hoodwink you into opening it. Not impossible, but also not that plausible, for privacyToolsIO readership, methinks.

p.s. By stark contrast, if your web browser is not patched with the latest security-fixes this can be a very serious risk to your overall privacy ... people use it all the time, and visit websites run by other people as the whole purpose of the browser-app. With archival-tools, usually it is better to have a tool that is easy to use and provides sound crypto, on all the platforms where you might want it, plus is able to unzip files you may have laying around (or inherit/receive) so that you Just Need One Tool for all your unzip tasks.

These kinds of things do not boost your crypto-powahz... they are "mere usability" ... but if you want proper crypto then you will have VeraCrypt or you will have Cryptomator or you will have Signalapp NotesToSelf or you will have CryptPad, or some other thing which is specifically about strong crypto. Zipfiles are not really about strong crypto, they are recommended because most endusers can understand them, and they can be implemented and put into practice with very little friction / difficulty / etc. (By contrast with VeraCrypt which is a hassle to install on desktops AND not officially supported except on those.)

Speaking of which, I would be interested whether an encrypted zipfile can be handled on Android... there is an experimental user-contributed rooting-required version of PeaZip that is not available in playStore and thus only for power-users.

> As the original post and poster is gone The username is gone, yes, but the posts themselves, are still available. For example on this comment, https://github.com/privacytoolsIO/privacytools.io/issues/867#issuecomment-484115198 you can click the "edited by ghost" thing in the comment-header, and see what they said prior to editing the text to say 'REMOVED'. You can see the OP info, the same way > open a new issue I might do that ;-) But since I've already saved a github draft of my reply, I'll go ahead and comment here one last time. > it need to wait for 7zip Update Have you looked into what version of 7zip is included with PeaZip, and about how long it takes before PeaZip gets the latest stable version of 7zip, included in their bundle? > and even then, is slower @beerisgood ...you mean, slower in performance, because of the Pascal-based GUI calling out to the CPP-based executable? Is it really slower in any human-perceptible way? Or you mean, "slower" aka the lag time until the bundled 7zip is upgraded to match the upstream, per my question above about security-patch promptness? While I agree that there are **some** security issues in zipfile-apps, but they tend to be rare and infrequent. Plus exploiting them is difficult... the adversary has to send you a zipfile, containing an exploit, and hoodwink you into opening it. Not impossible, but also not that plausible, for privacyToolsIO readership, methinks. p.s. By stark contrast, if your web browser is not patched with the latest security-fixes this can be a very serious risk to your overall privacy ... people use it all the time, and visit websites run by other people as the whole *purpose* of the browser-app. With archival-tools, usually it is better to have a tool that is easy to use and provides sound crypto, on all the platforms where you might want it, plus is able to unzip files you may have laying around (or inherit/receive) so that you Just Need One Tool for all your unzip tasks. These kinds of things do not boost your crypto-powahz... they are "mere usability" ... but if you want proper crypto then you will have VeraCrypt or you will have Cryptomator or you will have Signalapp NotesToSelf or you will have CryptPad, or some other thing which is **specifically** about strong crypto. Zipfiles are not really about strong crypto, they are recommended because most endusers can understand them, and they can be implemented and put into practice with very little friction / difficulty / etc. (By contrast with VeraCrypt which is a hassle to install on desktops AND not officially supported *except* on those.) Speaking of which, I would be interested whether an encrypted zipfile can be handled on Android... there is an <a href="http://www.peazip.org/peazip-linux-arm.html">experimental user-contributed rooting-required</a> version of PeaZip that is not available in playStore and thus only for power-users.

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#867