.ZIP Standard to Fragment?

fudgefactor7 writes "As IDG.NET tells us, the venerable .ZIP compression standard is about to undergo a bit of a schism. PKWare and WinZip, the "big two" in the .ZIP format biz are (unfortunately) going to be making their respective releases incompatible (to an extent) and an archive made with one may not be accessible from another. The problem lies with PKWare not giving information to WinZip, thus making WinZip to go it alone."

Comments

More importantly..

[grub]

What will my unix *zip programs be compatible with?

Re:More importantly..

[jat850]

Should be compatible with all of them:

Neither PKWare nor WinZip encrypt archived files by default. This means the vast majority of .zip files will probably continue to adhere to the old, universal format for the foreseeable future.

So it sounds like the only change is in the encryption methods used in each program.

Re:More importantly..

[pir8garth]

Correct...most users that want encryption probably do so after the fact, and thus the mainstream application of using zips shouldn't be effected. The only issue here that I see is if people, or more specifically companies agree to encrypt zip files for security purposes, they must make sure that a standard program is choosen/used to prevent corrupt file confusion.

Re:More importantly..

[kindbud]

What will my unix *zip programs be compatible with?

Zip.

Re:More importantly..

[holt]

Wait... is "usaly" the bzip2 compressed version of usually?

Re:More importantly..

[haystor]

ys

Re:More importantly..

[IdleTime]

Well, I heard that the new encrypted zip archives from PkWares program will have a new extension, .piz

Re:More importantly..

[archen]

"encryption" regarding Winzip is practically a joke. Just look up information on how to password crack a zip archive and typically they talk about how Winzip left "hooks" which makes breaking the encryption far faster. I've actually seen quite a few articles on encryption, citing Winzip's implementation as an example of how to botch encryption.

On the other hand PKWare's method isn't so great either. I've generally gone to using IZArc which can encrypt files using 256bit AES.

Re:More importantly..

[mnmn]

If they do make themselves incompatible, a third party will come along, incorporate both compressions and will win the market. Will you buy Winzip and have some files not open? Or download some other from sourceforge that will open any zip files.

And come to think of it, what further changes are they planning anyway? The zip format is very much standard and making something new that cant open zip files will not work, nor will compressing files in a format in which most unzippers will fail. The market itself will ensure the old zip format will remain.

Re:More importantly..

[artemis67]

What will my unix *zip programs be compatible with?

If PKWare suddenly closes their format, and if WinZip keeps theirs open, then it looks like WinZip will win by default.

It seems that we've been down this road countless times before. The way to win marketshare in the tech sector is to keep things open and allow other companies to champion your standard for you.

Re:More importantly..

[mcg1969]

We're not talking about the old password encryption methods; we're talking about the new AES-based encryption methods implemen ted in WinZip 9 and PKZip.

Re:More importantly..

[trickytree]

The Zip format has changed, and you will see this reflected if a) the archive is bigger than 4Gb, b) contains more than 65,000 files, or c) the user turned on Bzip compression in PK. 95% sounds about right.

Re:More importantly..

[cakoose]

I think that ZIP is more like .bz2.tar instead of .tar.bz2. This means that you can extract individual files without decompressing the whole archive. This is probably why Sun went with ZIP for JAR files (because it's convenient to get at some .class files without unzipping the whole thing).

This difference is also probably why .tar.gz and .tar.bz2 are usually smaller than ZIP archives. I don't think ZIP runs different files together so it can't take advantage of longer streams.

Re:More importantly..

[koko775]

how will they do that without "curcumventing a security measure"?

Re:More importantly..

[forgotmypassword]

Then why don't you try the following experiment. Save the same file to two different file names. Zip one file, then add the other to that archive. Notice the size difference in the two archives.

Re:More importantly..

[Annamite]

If they do make themselves incompatible, a third party will come along, incorporate both compressions and will win the market.

Like the modem war? The good old telephone modem war. What a laugh it was. History repeats itself. Or rather, the fools who do not learn anything about history repeat the same old mistake, AGAIN.

Splitting Those ZIPs

[Ken@WearableTech]

The post was a little hyped. PKWare and WinZip only split on the encryption of the Zip file. I for one have long since encrypted Zip files with PGP when I needed that security. Zip encryption has always been a joke, and I doubt that too many are going to replace what ever trusted methods they have come up with for PKWare or WinZip's new method.

It is too bad that they split, but I use Zip files for compression not encryption. The compression is still cross-compatible, so life will go on.

Re:Splitting Those ZIPs

[grub]

I for one have long since encrypted Zip files with PGP when I needed that security

PGP zips files before encrypting them. At least older versions did. See this page

Re:Splitting Those ZIPs

[Surak]

WinZip and PKZip are ALREADY incompatible in some areas.

From Pkware's web store:
# Virtually Unlimited .ZIP File Size allows for .ZIP files exceeding 4-gigabyte archive limitation of other .ZIP products; create archives in excess of a terabyte in size!
# More Files-per-archive allows a practically unlimited number of files files per .ZIP file â" greatly exceeding the 65,535 compressed files limit of other .ZIP products.


These two limitations used to appear in old versions of PKZip (2.04G and earlier), and still appear in the open-source (BSD license) Info-ZIP utilities, upon which WinZip is based. Thus for large zip files, WinZip and PKZip are already incompatible (i.e., WinZip doesn't support anything larger than 4GB, and supports a max of 65,535 files inside a Zip file -- WinZip will NOT read these files). I think there's also a mention of new compression methods not supported by WinZip as well, but I couldn't seem find it again.

Re:Splitting Those ZIPs

[agentZ]

They are still out there, thanks to Skylarov's old company. Elcomsoft makes an Advanced Zip Password Recovery tool.

Re:Splitting Those ZIPs

[Anonymous Coward]

anybody hitting those limits is a lamer or a file sharing pirate, probably both. kids these days. thank god for the mpaa and the riaa.

Re:Splitting Those ZIPs

[WD]

Yeah, but don't forget one of the main advantages of using zip... It'll join multiple files into one archive.

Re:Splitting Those ZIPs

[Surak]

Um, I've hit those limits before and I am neither. I've had to move *large* amounts of CAD data over FTP, and ZIPping or tarballing all the files down is the only practical way. Tarballing is fine until some you have to send it to some lame Windows user who complains he can't open it because WinZip insists on ungzipping a tarball to a tar file in a temporary directory first, rather than streaming it as happens on *nix with 'gzip -dc foo.tar.gz | tar xvf -'

Re:Splitting Those ZIPs

[Lumpy]

Zip encryption has always been a joke,

espically now. I recoeverd 3 Zip files last week from an employee's laptop who was "let go" and "forgot" what the password was.

Most of the zip cracking apps on the net are trivial and quite powerful when you put a 3ghz P4 behind it.

Re:Splitting Those ZIPs

[jdew]

tar? _all_ it does is join multiple files together

Re:Splitting Those ZIPs

[larry bagina]

maybe it's the tar.gz format that's lame. If you there's a gzipped tarball of 1,000 files, and you want to extract only the last one, you have to wait for the entire file to decompress.

That may be the unix way, but it's not the efficient way.

Re:Splitting Those ZIPs

[Phantasmo]

Yup, still does. It uses code from Info-ZIP (so GPG probably uses zlib, same thing) to compress the file before encrypting: a compressed file is, in theory, non-repetitive data and is therefore less crack-able.

So, try tar or compress-less zip to package up a bunch of files and then encrypt with PGP/GPG.

Re:Splitting Those ZIPs

[Mr Z]

I was finally fixed in a later service pack for Win2K, but NT4 suffers on.

I wonder how your signficiant other (or would-be significant other if you presently lack one) feels about Microsoft now, given they 'fixed' you. Now I know where their company name comes from, going around 'fixing' people. ;-)

--Joe

Re:Splitting Those ZIPs

[timeOday]

Yeah, that's what the .gz.tar format is for.

Re:Splitting Those ZIPs

[mickwd]

"That may be the unix way, but it's not the efficient way."

Except that the Unix way allows compression of the collection of files as a whole, rather than per-file.

To take an extreme example, consider tar-ing and gzip-ing the /usr/include directory, with hundreds of small files, many of which contain a very-similar GPL header. Only when the files are first collected together into a single tar file can this duplication be compressed away. Zipping the individual files will not be able to compress as efficiently (especially when files are added to the archive after its initial creation).

But, that said, the actual degree of compression is not the only consideration for a good compression format. For example, being able to add or remove individual files from a .zip archive is a useful feature in some circumstances.

Re:Splitting Those ZIPs

[ymgve]

Not really. RAR has two modes, 'solid' archiving where all the files in the archive is one big compressed stream, and 'non-solid', where each file is compressed individually.

Re:Splitting Those ZIPs

[klui]

Under HPUX 10.20/11.x all you need to do is recompile Info-ZIP with a flag and it will support large files. Never had bumped into max number of files before.

Re:Splitting Those ZIPs

[dipipanone]

Now I know where their company name comes from, going around 'fixing' people.

This is clearly one area where MS have learned from Eunuchs.

Re:Splitting Those ZIPs

[ehovland]

"a compressed file is, in theory, non-repetitive and is therefore less crack-able"

Sorry, a compressed file is very repetitive. The algos are well known. Compression is done prior to encryption because the resulting file is smaller then if it hadn't been compressed. The encrypting of files makes them much larger.

Re:Splitting Those ZIPs

[ComputerSlicer23]

Sorry Charlie, if a zip file was very reptitive, it'd be more compressible. A well compressed file looks like random data (so does encrypted data). If it doesn't, get a better compressor. Repeative data is redundant, compressing removes the redundancies. That's the general idea of compression.

Yes, the header will match the magic bytes, but that is also true of nearly any file format. All DOS executables start with MZ, GIF's start with a specific set of bytes. Linux executables normally start with ELF within the first handful of bytes, most perl scripts have perl on the first line. Every file format listed in the magic file has some easily recognizable format.

Also encrypting a file normally doesn't make it any large then to pad out the block size. I know that DES and RSA don't. I can't recall any from when I read the first edition of Applied Cryptography that did.

Kirby

*sigh*

[Vengeance]

boys, boys, boys... Let's all stop the fussin' and a feudin'

I LOVE you Winzip!
I LOVE you, PKZip!

*hugs all around*

There, isn't that better?

Re:*sigh*

[Alizarin Erythrosin]

Pretty funny coming from a guy named Vengeance...

Depends on how they handle it

[StillAnonymous]

I'm hoping that WinZip changes the file extension for their new format to make it clear to anyone who gets ahold of such a file that it is not a standard Zip file.

And how much time will it be before someone just writes a program that handles both formats natively? RAR, ACE, and all the other compressors already do handle Zip file just fine.

Re:Depends on how they handle it

[H0ek]

Hey, perhaps they can use the extension .WIP

Seems to accurately reflect the idea that WinZip is still a Work In Progress, eh?

How annoying!

[Junior J. Junior III]

Oh well, I guess I'll just have to keep using WinRAR.

Zip encryption's pretty useless, anyhow.

[Skyshadow]

While this is a Bad Thing from an open-standards standpoint, does anyone actually use the security features on zip? I'd think anyone concerned enough to protect their archives would want to use a serious encryption format.

So, if a fork occurs in a feature which nobody uses, does it make a sound?

Re:Zip encryption's pretty useless, anyhow.

[boer]

How's AES for serious encryption format? That's what the new WinZip 9 beta boasts.

The greatness of ZIP has been it's compatibility across platforms. It's so widely spread tool one finds it hard to image that a file couldn't be opened by receiver on some other system. When it comes to encryting files, it'd be important for ZIP to adopt one solution for strong encryption.

And no, in the real world, there is most likely no PGP or GPG where you have to send that important document encrypted outside your organization. Will they install because you ask? Most likely not. So go ahead, cross you fingers and send away unencrypted. That way you know the data will be readable by (at least) one receiver.

Re:Zip encryption's pretty useless, anyhow.

[PetiePooo]

How's AES for serious encryption format? That's what the new WinZip 9 beta boasts.

AES what (how many bits)? And how do they collect entropy? How do they generate the IV? Are there password complexity rules, or at least warnings on insecure passwords?

The actual encryption algorithm is but one small factor in determining the security of a system. People who say thinngs like, "It uses AES, so its secure," are the ones that the NSA, CIA, and FBI encourage, because they're the ones that can be easily fooled.

If WinZip9 uses AES with 56 bits, no thanks. That's not secure. If they use 128 bits, kudos.. its adequate for most uses. If its configurable up to 256, even better. However, using a published and reviewed encryption product like PGP or GPG would still be my method of choice.

I'd like to suggest Bruce Schneier's Cryptogram as a good source of applied crypto knowledge. My favorite section of his newsletter is The Doghouse, where he debunks dubious claims and "cryptographic snake oil".

Anything labeled as "proprietary" is generally bad when it comes to cryptography. Peer review is the best way to verify a system can be trusted. And that's difficult to do on closed-source products.

Re:Zip encryption's pretty useless, anyhow.

[CharlieG]

yep, and for a stupid reason

The company firewall will not allow certain kinds of files though (read things like source code and exes) - fair enough, but even if you zip the file, the block it. This not only occurs through the firewall, but inside the company too. So when we want to send a file, we zip with encryption. They can't open it to see what is inside, so they let it through

Not that serious

[Chris_Jefferson]

This is only related to the encryption. Those of us who have been using winzip for a long time will remember that winzip never used to handle multiple part zips, so if you wanted to handle them you had to point winzip at a "real" pkzip. I will be very suprised if the same system doesn't occur here. Also who is going to use zip's build in encryption anyway?

PKWare vs. WinZip?

[micromoog]

Goodbye PKWare.

Re:PKWare vs. WinZip?

[HohlerMann]

Goodbye PKWare.

Odd point of view because PKWare created the standard.

Re:PKWare vs. WinZip?

[steveg]

IBM created the standard for x86 PCs.

And lost control of that standard with the PS/2. By being incompatible with that standard and trying to force everyone else to move to the 'new standard' while simultaneously locking other vendors out.

Does it really matter?

[jdhutchins]

How much does this really matter? First of all, I bet most people are still using their unregestered shareware winzip from ages ago. Most people know that the zip encryption is pretty much worthless, so they don't bother. The people who want an encrypted zip file are probably going to encrypt it with a quality encryption program, such as gpg or pgp, AFTER they have it zipped. The person on the other end unencrypts it and then opens it. I know the article said "95% of the time it'll work", but I bet it will be more like "It'll work 99.9999% of the time".
Also, the basic format isn't changing. It's just the encryption part, so zip files will still be usuable by nearly everyone.

Re:Does it really matter?

[Darth Fredd]

Ah! Somone understands.

I use the "trial" version of Winzip (You've been using this for 683 days! This isn't free!) and since I *never* compress and I only uncompress when I download a new Quake/HL mod, its no biggie which utility I use.

I think this entire thing is getting blown *way* out of perspective. At risk of being repetetetive and a noing:

Who gives a crap about zip encryption?

Compatibility

[garrulous]

"The problem lies with PKWare not giving information to WinZip, thus making WinZip to go it alone."

Compression employed on this sentence may cause incompatibility with standard English.

best Winzip feature

[Mantorp]

switching the locations of the I accept and Quit buttons every time you open it.

Re:best Winzip feature

[The Bungi]

Perhaps you should pay for it and you wouldn't have that problem. $30 bucks is probably $30 more than most people here are accustomed to paying for software, but in my opinion it's worth it. I bought a license three years ago and it's paid for itself many times over since then.

Phil Katz .. the most depressing guy ever

[Saint Stephen]

http://www.jsonline.com/news/State/may00/katz21052 000a.asp

Re:Phil Katz .. the most depressing guy ever

[Mr_Silver]

From http://www.jsonline.com/news/State/may00/katz21052 000a.asp:

The genius who built a multimillion-dollar software company known worldwide for its pioneering "zip" files had died of acute pancreatic bleeding caused by chronic alcoholism.

Bizarre, I get pancreatic bleeding whenever I read any of John Katz's old articles.

Wonder if they are related.

Re:Phil Katz .. the most depressing guy ever

[MolecularBear]

Geez, sounds like he wasn't running a tight operation. All the girls in MY stripper-entourage are trained to drive me immediately to the hospital once I start puking blood and urinating uncontrollably.

Your joking!?!?

[altp]

What? you mean there's competing closed source applications on windows that break compatibility with each other.

Surely, you jest.

Altp.

D - M - C - A

[siskbc]

What about reverse engineering? If hordes of *nix programmers can do it why can't Winzip do it? Legal issues? ...?

Can I get a D?!?!
D!!!
Can I get an M?!?!
M!!!
Can I get a C?!?!
C!!!
Can I get an A?!?!
A!!!

What's that spell!?!?
Tyranny!
What's that spell!?!?
Bunch of assholes in Congress!
What's that spell!?!?
Lack of Innovation!

Dunno if either side would be big enough assholes to try it, but why couldn't you use DMCA there?

PKWare. Hmmm. Seems to me I've heard about that.

[AWhistler]

I used to know a PKWare. Let's see. I think the last time I used it was back in Win31 days! Until now I didn't care much about which one I would use. Now that they are diverging, it appears that WinZip will be the one I use since I can find it more readily than PKWare. Besides, I seem to remember a while back something about PKWare ceasing to be. Guess I was wrong.

Also, since WinZip is compatible with .tar.gz files, I'll stick with it. So in effect, instead of not caring, I just have to care enough to make a mental note to only remember WinZip and forget PKWare. And if I run across a PKWare-only file, either I'll have to trash it or download a trial PKWare long enough to convert the file, and then discard it.

uh, bzip2 anyone?

[Anonymous Coward]

Why are we still all using this archaic .zip, when there's stuff that's so much better?

Following the Big Boys...

[Kjuib]

sounds like PKware is following the route of all the other major software organizations. Sharing info with people, making friends, being helpful. Then when the chance comes - breaks away from the group and wont share with the others. Oh - wait - that isn't the big boys, that was kindergarden.

PGP as the new competitor

[Slime-dogg]

It seems as if PKWare and Winzip are moving into the realm that is dominated by PGP and the GNU variant. PGP compresses the data when it encrypts it, so that need was taken care of already. I wouldn't use either Winzip or PKZip to send an encrypted zip file, because PGP is more universally known, and can give you 2048 bit encryption.

AFAIK, the actual zip standard hasn't changed, which means that you'll be able to open zip files with either program (or the WinXP shell... heh). That's what I see most zip files being used for anyway... Windows based shareware / freeware. Stuff where encryption is not necessary.

The venerable tar.gz and tar.bz2 formats, thankfully, will not be dictated by stupid companies. :-)

We don't need ZIP anyways.

[drfreak]

LHA was much better even ten years ago. It was standard on Atari ST and Amiga computers. And it generally got better compression, too. To this day it's still installed by default on most Linux distros but nobody uses it any more.

Re:non issue ..

[afidel]

you would think so from the article, but reality so far has shown differently. I have already run into two instances where someone using the beta copy of winzip9 used the new format by accident and those people using pkware or xp's built in zip readers could not read the file because of some header issue or something like that. Once they rezipped the file with the winzip8 option (aparantly that's what they did as both posts said something to that effect) no one had a problem reading the file. I hope that whatever issue is causing this is removed before the release version.

Does it really matter?

[LegendNH]

I personally try and use winrar as much as I can. The only times I even use the "zip" compression is when I have to send a file to someone who can't use or doesn't have winrar installed.

Personally I would like to see this issue resolved because there really is no need two have two different zip formats out there. My hope is that winrar will implement both (if possible) and just let it be.

Who the hell are PKWare?

[Phreakiture]

Yes, I do know the answer to that, and so do most of you, but the hordes of Windows users out there do not.

What will happen is that the WinZip will win this feud, simply because it is what people use.

...and since the problem stems from PK not sharing information, UNIX zip implementations will likely behave in the same manner as WinZip.

Does it really matter...

[Suicide]

Microsoft bashing aside for the moment, since Windows XP has built in support for .zip files, does this even matter? Your average windows user doesn't use encryption, and those in the know, use better formats of security.

Re:Does it really matter...

[The Bungi]

This is going to be interesting, actually. Support for ZIP files in XP is implemented as a shell extension that makes them behave like directories. I personally disable that and use WinZip, but I wonder what will happen if enough users complain about not being able to read .zip files from XP - Microsoft's clout could very well come into play in favor of one of the two feuding standards, if only to make sure the shell behaves as expected.

Re:Windows ZIP

[MikeFM]

For that matter just use tarballs. I have tar, gzip, and bzip2 all working just fine in XP. Tarballs made with either gzip or bzip2 will be smaller than zip files most of the time anyway.

Besides I get really sick of having to provide multiple copies of source code just because Windows programmers can't figure out what to do with a tarball. C'mon! Programmers should know these things.

Just use WinRAR.

[BoomerSooner]

It does ZIP, ACE, RAR, ...
tar zxvf
gzip

What else exists?

Oh yea I forgot .sit (I love the fact that OS X has tar.gz built in) Hell I never send Mac friends .sit files. tar.gz all the way baby!

PKWare is hosed.

[fmaxwell]

Frankly, with the popularity of Winzip, PKWare is making a grave error. PKZip, while perfectly good, is running a distant second in popularity based on my observations. Making their product produce incompatible ZIP files is a sure way of eroding their market share even further.

You do that sort of thing when you are the industry leader. This would be like Corel deciding that they were going to set a new standard for .DOC files that Microsoft would not be able to read. The result would be that Corel would lose their remaining six users of their word processor.

Try something new

[TheNumberSix]

Perhaps if you find Winzip annoying, you might like to try a nice OSS alternative zip program without annoying nag screens?

I like 7-zip, it's free, has a context menu, supports tar.gz (which the native WinXP unzipper doesn't do) and it's light-weight.

Spec Release *After* the Product's Done?!?

[kmactane]

In paragraph 14 of the article, just before the heading "Other Options": "But the spec should not come out until a product is done, says Steve Crawford, PKWare's chief marketing officer."

I'd already been kind of wondering what was up with PKWare not documenting stuff. Now I'm starting to think they're just messed up. Specs should be released first (IMNSHO); then everyone who needs to support the spec can write to it.

We'd scream bloody murder if Microsoft released a new version of IE that implemented some bizarre new HTML or HTTP standard, even if they said they'd publish a spec for it a few months later. And the same goes for Mozilla. We very rightly insist that browser makers build their software to support the already-published specs from the W3C and IETF.

Similar comments apply to Apache and HTTP, CGI, and various other standards; to Sendmail/Postfix/Qmail/etc. and SMTP; to Linux and the POSIX standard... this is what standards and specs are for

Free clue to PKWare's Steve Crawford: you're just a marketing director. Let your CTO worry about specs; you're just making your company look worse.

7-zip Better than the Rest

[Anonymous Coward]

Windows users rejoice! Use 7-zip (click here) and end the WinZip-PKWare monopoly ;).

Mod away, but remember.. it's open source MWUAHAHA!

Did we miss the point, here?

[Corvaith]

The whole point of this story is that PKWare is doing some kind of encryption thing that they aren't sharing with others. So only PKWare's zip program will support said encryption. It isn't just WinZip that won't. WinRAR will still support zip the way it has, sure. But it won't support the new encryption deal.

So switching doesn't do a hell of a lot of good unless you switch to theirs. Which is probably the plan, I guess.

Remember these?

[wumarkus420]

I vote we go back to LZH, ARJ, or ARC

I miss the BBS days where you needed about 10 compression programs.

This just in: MS-DOS Standard To Fragment!!!

[ites]

Reliable news sources (possibly an Iraqi Minister of Information, or worse, a White House Official) tell us that due to disagreements between Digital Research and Microsoft, the latest MS-DOS release (11.2a) will no longer be compatible with DR-DOS 11.x.
All five remaining DOS users are likely to be severely complacement. For more information on this stunning development, we asked...

PKWare is dead, too

[Schnapple]

The problem lies with PKWare not giving information to WinZip, thus making WinZip to go it alone

Well then there's probably not going to be much of a problem, given that almost no one uses PKZip anymore. I'm young here but IIRC, everyone in the world used pkzip/pkunzip in the good old DOS days, but then when Windows started to rise, people started looking for a graphical frontend to it, and WinZip pretty much took the lead. I don't recall if WinZip was just a frontend in those days but before long it had integrated ZIP support.

Also, memory serves that Philip W. Katz, the late founder of PKWare, worked with IDC to make the ZIP file format public domain, both because it wasn't entirely original to either organization, and also because it would never take off were it not. So here then we have PKWare, in the wake of the death of Katz, trying to "pull a Microsoft" and make their version incompatible with others in the hopes that more people will use their version. For that matter, I think PKWare's main claim to fame for years now has been that they were "the first".

However this has the potential to backfire. PKWare may be trying to "pull a Microsoft" but they are not Microsoft and so now they're in the position where their product now creates the incompatible file. A file made with PKZip may not work with others, a file made with WinZip almost definitely will.

Aww great..

[TeknoHog]

People who break compression standards should be tarred and gzipped... I mean feathered.

They're hardly zip files

[maggard]

First off the issue isn't the compression, it's encryption. Thus the problem isn't a new one, it's been around since the first extension of zip to involve other sorts of mangling. No standard zip library can read those, it's just that the big two commercial vendors have 'til now kept compatibility with each-other's encryption routines.

The unfortunate part is that this is even being called "zip" at all. These aren't, they're zip with proprietary extensions for a completely different purpose. Zip is being used as a brand name and being "embraced and extended". Truth be told these should now be called zep or something files, not misrepresented as simply zip compressed files.

What will this all break? Well for the suckers who use the encryption they're locking themselves into that one vendor's proprietary extensions. They won't be able to send their compressed files or archives and reliably assume they'll be readable. With zip now a standard part of many OS's (even WinXP now includes it) these mislabeled files will cause confusion and increased complexity.

What can folks do about this? First reconsider corporate licenses for these increasingly un-zip applications. No need to increase the Help Desk's burden with unnecessary/non-standard extensions. Send out a memo reminding folks about policies regarding encrypting company material, the management of the keys used, and the real quality of the encryption used. Look at the free alternatives to the commercial apps, there's little that these applications do that can't be done just as well with free tools.

Zip's value lies in it being a standard. Don't support inappropriate proprietary extensions to it.

Re:Are they stupid?

[martin-k]

Au contraire. Compressing first makes pattern-detection in encrypted data more difficult. That's why PGP compresses first, then encrypts (besides the fact that PGPing something increases its file size, and compressing offsets that).

Re:Karma-Burning Gripe on Link Style

[DrVxD]

But since 99.9% of /. readers never follow the links and assume that the whole story is in the headline, who cares?

W - R - O - N - G

[FallLine]

The DCMA explicitly allows reverse engineering for interoperability and this is precisely what WinZip would be doing. http://www.loc.gov/copyright/legislation/dmca.pdf, Page 5, Exception #2. Please read it for yourseld and grab a clue. The tired assertion that the DCMA kills innovation is tired and largely false (at least insofar as it is popularly presented on slashdot)

Re:W - R - O - N - G

[shaitand]

Actually the DMCA does NOT allow reverse engineering of security mechanisms... like oh... pkware Encryption algorithms...

Re:W - R - O - N - G

[shaitand]

you mean like DeCSS lets users decrypt and watch dvd's in the roughly the same manner the licensed technology does?

Re:W - R - O - N - G

[Anonym0us Cow Herd]

The DCMA explicitly allows reverse engineering for interoperability

The DMCA explicitly allows you to go broke defending against frivolous lawsuits, trying to educate the judicial system about what constitutes interoperability.

After all, if it is compatible with the new format, then you must have stolen intellectual property, violated a trade secret, or done some other dastardly deed. After all, the proof of your crimes is obvious and evident: it goes against the wishes of a corporation.

Re:W - R - O - N - G

[mcg1969]

Ah, there is a big difference between this and DeCSS.

The CSS encryption standard was well known, so one could easily write a functioning DeCSS program without violating the DMCA---with one significant exception: the encryption keys were not made public. Reverse engineering was used to retrieve those keys and thereby make DeCSS a functioning program.

With PKZip, the encryption method is not known and must be reverse-engineered, but the encryption keys are externally supplied by the user. Therefore, you aren't circumventing any copy protection by reverse-engineering PKZip's protection, because you still can't "break" the copy protection of any ZIP file whose key you do not know.

Re:W - R - O - N - G

[wurp]

The FUD density is getting pretty high here...

The necessity of having DeCSS to allow Linux users to view DVDs is questionable? By whom? On what grounds? What's the alternative? I don't know of any way to play a DVD on Linux that doesn't involve DeCSS.

DeCSS gives people the ability to copy DVDs? What was keeping me from copying them before? Put the DVD in the drive, copy the file(s) to your hard drive. Burn to another DVD if you like. No DeCSS required. The copied DVD plays just fine.

Limiting playback to devices with licensed keys is quite reasonable? As I demonstrated in the last paragraph, it's total bullshit to say that it prevents privacy. All it does is let the MPAA control who can create DVD players and let them obsolesce DVD as a format whenever they want, let them control when videos can be released in different markets, and let them charge the DVD manufacturers for the privilege of making hardware that plays DVDs.

Are you employed by the MPAA or an MPAA affiliated studio? Your responses certainly don't look like those of someone with Joe Public's interests in mind.

Or are you just a troll?

Re:W - R - O - N - G

[OrenWolf]

What??

DeCSS Did nothing to prevent playback of anything, nor was it it's purpose.

The ONLY purpose of DeCSS was as a method for the DVd Consortium to reap license fees on the tech. DeCSS licensed *players*, not copyright holders. Piracy isn't the concern of the DVD Consortium with DeCSS - loss of revenue due to unlicensed *players* is.

And By the way, the Law doesn't say that reverse-engineering is legal only if the result isn't "too easy to circumvent the technology". The law shouldn't (and doesn't) care. Reverse-engineering for the purpose of interoperability, no clause about being too easy to "circumvent the technology".

PKware's still around?

[gstevens]

PKWare is still in business?

Long live 2.04g!

Winzip's "standard" will win by default

[The Kryptonian]

Most zip files, sorry to say, are made with WinZip now, so all that PKWare's reticence has accomplished is the balkanization of their own product.

Open Standards

[nuggz]

Maybe we should just use formats based on open standards. Then the actual software people use is irrelevant.

hmm

[Suppafly]

luckily, most people stopped using pkware when they stopped using dos, so this doesn't present a problem.

Zips and Zips and Zips

[cshark]

That's a real shame. I thought the zip specification was open to anyone who wanted to use it? I stopped using Zips about three months ago in favor of the 7zip format. 7zips are smaller and more secure. The best part about 7z's is that it's an open source format. Fully documented, and entirely free. They also tend to be a lot smaller than standard .zip archives. Just an opinion.

Who cares?

[Ignorant Aardvark]

I haven't used .zip in a long time. There's, quite simply, much better stuff out there. My overall favorite solution is .tar.gz, but there are always times on Windows machines I want to split a file into multiple parts (like to post it on a newsgroup), so then I use WinRAR. Everything I've mentioned has better compression algorithms than Win/PK Zip, and I just can't imagine going back.

As I am sure

[Mensa Babe]

many of you have already mentioned, I personally would rather stick with .tar.gz and .tar.bz2, while not touching the .zip so called "standard" with a mile long stick. If (by which I mean IF) this .zip thing was a standard, it would not be going to "fragment," period. I think everyone will agree with me. Gzip is a standard. Bzip2 is a standard. Tar is a standard. Zip is NOT a standard. And I see absolutely no reason to use slower, compression-ratio-wise poorer, proprietary, as well as otherwise inferior "standard" (notice the quote marks), when we have real standards available. I frankly agree with most of people about this subject. It's a good thing, that this news has been posted on Slashdot.

Re:As I am sure

[yoshi_mon]

Gzip is a standard. Bzip2 is a standard. Tar is a standard. Zip is NOT a standard.

If you only use *nix systems then yes, that is correct.

However for many years the Windows standard of compressing files has been the zip. Ask a standard Windows user what a tar, bz2, or tgz file is and will have no clue.

While it's always good to have a *nix perspective on things here on /., to say that zip is not a standard in the Windows world is to ignore the reality of the situation.

You know what I find funny about all this?

[xQuarkDS9x]

What I find funny is that PKWARE will basically die off from this, no one I know from the workplace, friends, or even home users use anything PKWARE related. They all use Winzip or another windows tool. Hell it's been 10 year's since I even used PKZIP from PKWARE, and back then I was on a 486 machine with DOS 5.

It's also funny how people are still using a archiving format thats been around since 1988 at least, it's OLD and compresses like crap. Especially when there are SUPERIOR and much better compression formats out there such as

ARJ
JAR
RAR
UC2
ACE

All of these formats compress better then ZIP, yet you are hard pressed to find ARJ/ACE/JAR/UC2 files on the net, RAR files you may find here and there.

distant second? thats generous

[Mondain98]

PKZip, while perfectly good, is running a distant second in popularity based on my observations.

I think the reality is that PKZip is running far behind. I'll go so far to say that RAR is ahead of them. I use RAR over ZIP any chance I can; if it werent for compatibility with "administrative assistant" types, I would do everything in RAR. Better compression, better features.

And the winner is...

[Merlin_]

Whichever one is embedded into Windows XP.

Re:I thoiught they were already irrelevant....

[Anonymous Coward]

"since the days of MS-DOG^HS passing"

haw haw haw!

get it?

because - hahahaha
MS-
DOG? but then, I inserted a BACKSPACE SO YOU COULD SEE WHAT I WAS TYPING BUT THEN COULD DO THE BACKSPACE IN YOUR HEAD TO SEE WHAT I ACTUALLY WROTE!

Pure hilarity!

MS-DOG!
HAAHHAHAHAHA

Uh huh

[siskbc]

Tell that to lexmark. I understand what the DMCA was trying to do but that's a shitload different from the way the DMCA is getting implemented.

Anyone who assumes that the way a law is written is the same as its implementation, or better yet, its ability to be used as a legal bludgeon, REALLY needs to get a clue.

Depends on dumping.

[twitter]

So, if a fork occurs in a feature which nobody uses, does it make a sound?

It does when the company in question starts dumping product and people start using it. Just let them promote the useless feature and wait for the ass pains to set in. If they are dumping a "client" ala Adobe PDF, people can say, "Don't complain, the client is free." Ugh, at least Adobe released file specs.

If a company decides to go 20 years retro and create a new non free file format, that's just one more dumb format to get in the way. You would hope that people knew better by now, but they don't. Witness the growing popularity of M$.DOC, the dumbest way to exchange text ever.

Why tar/gz and tar/bz2 suck, compared with zip

[dangermouse]

I'm a *nix user, and I've been using zip over tar as much as possible for years now. Why? Two words: RANDOM ACCESS.

You can stick with the tape archiver if you want. You'll have the pleasure of waiting for your massive single file to finish decompressing, so you can then sequentially search the resulting decompressed archive for the files you actually wanted.

In the meantime, I'll be plucking decompressed files right out of the middle of my zip archives, in a fraction of the time.

Incidentally, if you're so anal about your compression ratio, why not compress with a good compressor (like bzip2) and archive with a good archiver (like zip)?

Re:Why tar/gz and tar/bz2 suck, compared with zip

[73939133]

In the meantime, I'll be plucking decompressed files right out of the middle of my zip archives, in a fraction of the time.

That's the difference between gadget freaks and users. Most users extract single files so rarely that they really don't need an entirely different format. For the once-in-a-blue-moon event that they have to find a single file, they probably just untar the whole archive, find the file by browsing the directory tree, and then delete the tree. But gadget freaks are so happy to have just the right gadget for a particular problem that they will go through any cost to acquire and use a gadget.

And when you have an application that needs a random access format, zip is pretty lousy: you'd be better off with a loopback-mounted file system (like MacOS .dmg) or a small database.

Open format via closed review? Doubleplusgood!

[djNocturne]

From the article:

"Certificate-based encryption is still a work in progress," says Jim Peterson, PKZip chief technology officer. "We're not publishing it because we still have a number of features to add."

Sing it, brother. So essentially, cert-based encryption in the zip format is too much of a moving target to bother posting a complete spec, even a preliminary one, but not enough to prevent you from introducing the feature into your product almost a year ago? Solid.

But is this simply one man's poor choice of words? Maybe he's being quoted out of context. Luckily, another suit quickly steps in to disabuse us of that notion:

But the spec should not come out until a product is done, says Steve Crawford, PKWare's chief marketing officer.

Read: "We can't publish the full details of changes to our open format until our own commercial implementation has gone through a few revs."

Okay, I need everyone who loves to bash Sun's handling of Java to line up on the left over here. Please proceed in an orderly fashion ... we don't need any pushing and shoving. You'll be issued a standard wooden stick, and you'll each get one whack at the PkWare piñata.

Giving Sun a little credit, for at least having the good sense to provide some form of community review process on proposed specifications, is optional, but highly recommended.

Those who wish to play the role of PkWare apologists should instead use the wooden stick to beat themselves unconscious ... to the benefit of everyone else.

The joke's on them...

[poptones]

If you look at the volume of archives posted to usenet (and elsewhere) it's pretty obvious that both these are simply trying to catch up to RAR. The only thing I use winzip for now is opening windows CAB files. And I'm pretty sure winrar does that, now, too.

Against the ZIP format's origins - Zip history 101

[tbuskey]

*sigh* computer people don't know history.

Back in the DOS days (1986?) there was a format called ARC used by the program arc. Everyone used it on the BBSes. Phil Katz came up with his own programs, pkarc and pkxarc. One created, one extracted. He added a new compression scheme and his apps were *much* faster.

BBSes converted. When everyone is on 8088s and 2400 baud, every bit and cpu cycle counts.

arc sued PK and won. PK had some arc code in pkarc/pkxarc or something. PK vowed neither he nor anyone else would be in that position and released the zip format.

At the time, there was zoo, lha also competing. zoo was cross platform (DOS, Unix, VMS). lha was small and fast, producing small archives. zip aimed to be both.

BBSes converted overnight. The arc format disappeared. Other formats persisted for awhile, but zip stayed mainstream.

It's sad that PKware is on the other side of this...

Re:Why not...

[archen]

I'm not a big fan of asymmetric cryptography for stuff that is going to just sit around. As far as archive stuff, if it doesn't use blowfish, IDEA, or AES I probably just won't use it.

NSIS

[UnConeD]

Thankfully there's still some great Windows software around, like NSIS (by Nullsoft). It doesn't bother unzipping itself first (single EXE), it is small, it is powerful, open-source, .... The only thing that sucks is how you create an installer, you have to write a script in a language that's a mix between assembly, PHP and C. It's not at all hard if you're a programmer, but this is the reason why NSIS will never reach those stupid companies that put their Installer in an EXE in an EXE in a ZIP.
If someone were to make an NSIS-script wizard (for people who can't use the script-system) for basic actions and commonly used stuff, it would put InstallShield and friends to eternal shame.

Re:PkWare has already published the file INFO!!!!

[egoots]

...never mind.

I finally got through to the original IGN news article posting (and not just the slashdot replies) and it clarifies what the actual issues are. My parent post here didnt add anything useful.

Even More Importantly..

[aphor]

If you use GnuPG(GPG) or PGP to encrypt your files, you get compression too. There is absolutely NO reason to use a nonstandard compression utility to do low quality encryption.

Nico Mak?!

[leshert]

I've used WinZip, and it's nice and all, but I just have a hard time using a product from a company with that name (third entry from the top).