On 12/20/04 9:01 PM, "Rene Rivera" <grafik.list@redshift-software.com> wrote:
Daryle Walker wrote:
I dislike the idea of executable-wrapped archives in general. You only have a creator's word that the file isn't actually a Trojan and/or infected with a virus. (Even a trustworthy creator may get overridden by a cracker's altered archives.)
That is true regardless of type of archive. The source archives are just as susceptible to tampering as the executable ones. And such tampering has occurred in other open source distributed material. [TRUNCATE the rest as checksumming doesn't affect whether or not embedded extraction code is a good idea.]
But standard archive formats are not executable in and of themselves. Expanding a passive archive won't initiate any attack vectors for mal-ware. An archive with executable code attached adds a potential attack vector with dubious benefit. (The real problem is that the OP's un-zipper sucked performance-wise, but an embedded one may be just as bad. The fix is to use a better extractor.) Whether or not the files _within_ the archive have been perverted is a separate matter from what I originally talked about. -- Daryle Walker Mac, Internet, and Video Game Junkie darylew AT hotmail DOT com