Misguided call for a 7-Zip boycott brings attention to FOSS archiving tools
- Reference: 1656347412
- News link: https://www.theregister.co.uk/2022/06/27/7zip_compression_tool/
- Source link:
However, it seems [2]criticism for Igor Pavlov and his FOSS compression app 7-Zip is somewhat overblown and may reflect the anti-Russian sentiment of the times.
[3]7-Zip has been around since 1999 and in that two-decade span there have been more widely used Windows compression tools (WinZip and WinRAR, in particular) they are shareware, so try-before-you-buy versus free.
[4]
There's absolutely nothing wrong with the shareware model. It has been around longer than the modern FOSS ecosystem, and there are some excellent shareware tools. However, a lot of people aren't really trying before a potential purchase: they never intend to pay. And if that's the case, then you might as well use free software and avoid nag screens.
[5]
[6]
Let's dissect the critical points around 7-Zip. The blogger, identified only as [7]Paul , claims that 7-Zip isn't really open source because the code isn't on "Github, Gitlab, nor any public code hosting" . That is not a requirement of the open source [8]definition . 7-Zip's source is [9]available on Sourceforge and is licensed under the GNU [10]Lesser GPL .
[11]SpiralLinux: Anonymous creator of GeckoLinux puts out new Debian remix
[12]Only Microsoft can give open-source the gift of NTFS. Only Microsoft needs to
[13]'Now' would be the right time to patch Ubuntu container hosts and ditch 21.04 thanks to heap buffer overflow bug
[14]The year ahead in technology fail: You knew they were bad, now they're going to prove it
There is no need to use Git source code management if you don't need it. Git's a complicated tool, which is why Linus Torvalds gave it the [15]name : it's British English for a hostile or uncooperative person. 7-Zip has a single author, [16]Igor Pavlov , and if he doesn't want to use Git, The Reg FOSS desk doesn't blame him. The author has used Git professionally for many years, cordially loathes it, and strongly suspects he is not [17]alone in this.
As evidence of the difficulty of building 7-Zip from source, "Paul" links to a [18]discussion from 2010. The counter-evidence that it's possible is that there is at least one fork of 7-Zip out there: [19]NanaZip , which claims better Windows 10/11 integration.
We suspect that Pavlov's choice of LGPL, rather than full GPL, may be because 7-Zip includes the [20]unRAR library so that it can unpack files in the [21]proprietary RAR format.
[22]
"Paul" also points out to security vulnerabilities in the app. This is true, it occasionally does have some, as the Reg [23]has discussed in the past . The latest one is [24]described mostly in Turkish, but [25]discussion on HackerNews suggests it is somewhat arcane, and whether it allows privilege escalation is [26]disputed .
To its credit, the blog also points out some alternatives to 7-Zip, including its Nanazip fork and the FreePascal-based [27]PeaZip .
PeaZip does have a significant bonus for Linux users: it boasts a full GUI, whereas 7-Zip only provides command-line tools for Linux. We installed the Flatpak [28]package to have a look, and while it works fine, it does pull in a whopping two-thirds of a gigabyte of KDE dependencies to do it, so for now, we'll stick to [29]Engrampa .
[30]
Nix Sanctuary also condemns 7-Zip simply because it is Russian, due to the ongoing invasion of Ukraine. We certainly have sympathy for that: the Reg FOSS desk is relatively close, in purely geographical terms. Russian developers with professional GitHub accounts already face [31]sanctions , and of course there have been [32]other anti-war actions on the site . Without evidence of any personal complicity from Gospodin Pavlov, that seems a step too far for us.
We suspect that Nix Sanctuary may invoke the Streisand Effect on 7-Zip, which for now will remain the Reg Zip-management tool of choice on Windows. ®
Get our [33]Tech Resources
[1] https://www.reddit.com/r/opensource/comments/vkjl80/boycott_7zip_limited_open_source_security_issues/
[2] https://nixsanctuary.com/boycott-7-zip-limited-open-source-security-issues/
[3] https://www.7-zip.org/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YroogELTmKGSxUsPDO5MQAAAAEQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YroogELTmKGSxUsPDO5MQAAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YroogELTmKGSxUsPDO5MQAAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://nixsanctuary.com/about/
[8] https://opensource.org/osd
[9] https://sourceforge.net/projects/sevenzip/files/7-Zip/22.00/
[10] https://www.gnu.org/licenses/lgpl-3.0.html
[11] https://www.theregister.com/2022/06/20/spirallinux_new_debian_remix_from/
[12] https://www.theregister.com/2022/05/09/only_microsoft_can_give_open/
[13] https://www.theregister.com/2022/01/20/ubuntu_2104_eol/
[14] https://www.theregister.com/2022/01/04/opinion_column_technology_in_2022/
[15] https://www.urbandictionary.com/define.php?term=Git
[16] https://sourceforge.net/u/ipavlov/profile/
[17] https://xkcd.com/1597/
[18] https://sourceforge.net/p/sevenzip/discussion/45797/thread/239638cc/
[19] https://github.com/M2Team/NanaZip
[20] https://www.unrarlib.org/faq.html
[21] https://www.rarlab.com/license.htm
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YroogELTmKGSxUsPDO5MQAAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://www.theregister.com/2016/05/12/popular_zip_tool_7zip_pwned_pain_flows_to_top_security_software_tools/
[24] https://github.com/kagancapar/CVE-2022-29072
[25] https://news.ycombinator.com/item?id=31070256
[26] https://nvd.nist.gov/vuln/detail/CVE-2022-29072
[27] https://peazip.github.io/
[28] https://flathub.org/apps/details/io.github.peazip.PeaZip
[29] https://github.com/mate-desktop/engrampa
[30] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YroogELTmKGSxUsPDO5MQAAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[31] https://www.bleepingcomputer.com/news/security/github-suspends-accounts-of-russian-devs-at-sanctioned-companies/
[32] https://www.theregister.com/2022/03/18/protestware_javascript_node_ipc/
[33] https://whitepapers.theregister.com/
Re: I like 7Zip.
Well said.
The behaviour of the Russian* government/military may be despicable but it should not justify xenophobia (or worse) against individuals who happen to by born of that country.
Individuals supporting said government action should be called out, but there is no evidence here of that.
[*] Also see China, Iran, etc.
Re: I like 7Zip.
-> The behaviour of the Russian* government/military may be despicable
How many did the West kill and murder in Iraq based on lies? The adjective "despicable" is a little closer to home than many would admit.
Re: I like 7Zip.
And here are El Reg's representatives of the international troll brigade! Likely other nation state actors will follow suit shortly. Anyone else remember the sunny days when these forums were populated by actual readers AKA home grown idiots?
Still, wouldn't want them to feel to lonely, maybe we can get Amanfrommars to talk to them.
Re: I like 7Zip.
"How many did the West kill and murder in Iraq based on lies?"
Accepting that Russia is killing and murdering based on lies is a good start for you.
You can't defend Russia because its position is undefendable.
Your comment is a fallacy. Should Russia be allowed to do anything they please because USA something-something-smallpox-blankets-something in its own bloody history?
I live in the west of Russia but my country didn't have anything to do with Iraq war. The west is more than USA, as you well know it. My critique of Russia as a Finnish citizen is not borne out of care for USA but for the deplorable actions of Putin and his cabal.
Re: I like 7Zip.
Imagine the protests if it was suggested that UK or USA random individuals should be penalised for their country's illegal incursions into Iraq, Syria or Libya, or the recent murder of that Iranian general.
Re: I like 7Zip.
My street's YouKnowWhat discussion group had a post asking for things to go to refugees in Ukraine. I dropped some kids' sleeping bags off with a neighbour I hadn't met before, who was delivering stuff to the Polish Club. She turned out to be Russian.
If a userland program allows privilege escalation simply by opening files and crunching numbers, that's on the operating system, not on 7zip...
I'm glad that somebody else noticed this.
Thank you for an article that shows some sanity in these insane times.
7-zip will remain my choice of zipper too.
Cheers
7-Zip works and has done for a long time.
I have used 7-zip for a long time and it works.
The nationality of the person who coded it is NOT of any concern of mine.
The only Russian(s) I have any ill-feeling for is Mr Putin and to a lesser degree his enablers.
Knee-jerk anti-russian campaigns are not of any use, as it enables Mr Putin to continue his 'the west hates Russia/Russians' narrative and gains support for these ideas.
I will continue to use 7-zip as it is a good and useful piece of s/w.
A couple of points
"Paul" sounds like a total spanner. [An alternative term for a knob/knobhead].
-> British English.
How many more times do I have to read this? We do not speak British English in the UK. We speak English. Other countries may speak their own dialects of English and prepend their own adjectives, if they so desire.
Re: A couple of points
Also, there are many dialects of English within Britain. I speak Scottish English. This is not the same thing as Scots. Scots is a different language. I understand it but don’t speak it.
Re: A couple of points
"How many more times do I have to read this? We do not speak British English in the UK. We speak English. Other countries may speak their own dialects of English and prepend their own adjectives, if they so desire\"
Fine in theory but less so in practice. Many apps may have an option for 'English' but don't specify which type. When it auto-corrects you find it isn't. Then comes the date misunderstanding ...
Time for the Milton Jones joke: "got offered a job in Texas teaching geography as a second language"
Nutrition Warning
The post may contain sugarcoated nationalist ideology. May cause indigestion and upper lip hair growth in larger doses.
Something on a clickbait website incites arguments…
NFT
it's British English for a hostile or uncooperative person.
You mean they named it after me?
Seriously, this kind of smearing is beyond comprehension. 7z was my favorite, I have to thank a much younger and wiser ex-colleague for point me there!
Hi, PeaZip author here.
While I appreciate (and thank) the effort of FlatHub community in building and maintaining a Flatpak version of PeaZip, I would recommend to most users to chose one of the available Portable packages for Linux https://peazip.github.io/peazip-linux.html to test the application without requiring installation, with a 12 MB download.
About the main topic, I'm saddened the moment we are living is threatening our long-living assumption of the possibility of a world where people of different countries and cultures can freely cooperate for a common good, which is one of the main pillars of Open Source spirit. I can only wish Igor to keep up the good work.
Well said mate, on here we are all equal. Nationality doesn't matter (unless you're from Mars).
I love 7-Zip and hate that people are using Igor Pavlov in a political attack.
We installed the Flatpak package to have a look, and while it works fine, it does pull in a whopping two-thirds of a gigabyte of KDE dependencies to do it,
When
Bandzip
I quite like the (Free) Bandzip. Just saying.
nginx russian origins
Nginx has Russian origins (before F5 bought it) but I don't see people complaining about that one.
Not my problem
I use whatever I need to use. Unless the company is involved in war crimes or human right violations, I don't care what they do. They can sort it out or not. I'll find something else if worse comes to worst.
I've got my own damn problems fighting off scammers and grifters and assorted other troublemakers that directly impact my life. The existential can get in line.
I like 7Zip.
I use it for all my file compression needs. I don't care that the coder is $Nationality, I merely care that they've done a good job, are doing a good job, & will continue to do a good job for as long as the program is supported.
To the fear mongering troll, I hope you trip off a curb & fall under a donkey suffering from excessive runny fecal explosions.