Re: why I like having a proprietary archive format

[nathan@visi.com (Nathan Mates)]

In article <5gqjf7$3hm$1@europa.frii.com>,
Randy Shackelford <shack@deimos.frii.com> wrote:
>I've read Nathan's bellows about how Stuffit uses a proprietary format for
>its files so many times now, I thought I'd tell anyone who cares why it's
>a good idea to have such a format. It's good for a simple reason: password
>protection.

   Tip: .zip files can have passwords too. And they're publically
documented, with source in C readily available on the
internet. Knowing the structure without the password doesn't help
much. And for most platforms (except the GS), you can always encrypt
(3 letters: PGP) after using a publically documented compression
format. Still not going to help much when trying to crack a 1024
bit key...

   Before you go off on some purported 'feature' stop to consider
(1) if it does do what you claim it does, and (2) nothing else does
that. Just admit that these proprietary formats are an evolutionary
dead end getting in the way of public data transfer, and deal with
it.

>If you want a form of security for your archives, you don't want any
>ol' schmuck to write a program to unarchive the files.  If that were
>possible, someone could implement an unarchiver which doesn't
>support password protection, and your security goes right into the
>crapper.

   If your idea of security is to encode the password into the file,
and just check against it, with all the compressed data just the same
as without a password, Microsloth has a job for you designing their
latest security code. [Believe me, they've pulled such boners] Anyone
with a clue as to security would encode the compressed data against
the key such that without the key, it is just random noise. Cryptology
has gotten to the point where you can take a key and encode a file so
that it'd take millions of years of computer time to break a
key. Banks use these things to handle electronic transfers, and it
works for them.

   PGP is a publically encryption format that uses the products of
very large primes to encode stuff up; a 2048 bit key is essentially
uncrackable (see millions of years above) without math coming up with
a fast factorization algorithm. [None is known to date, and so PGP and
related algorithms are trusted]

   A PGP'd .zip or .gz or .shk or .txt or .gif or .sit is pretty much
unviewable without the key, proprietary internal format or no. I
believe the password protected .zips are pretty much the same way--
you can't really do squat without the key.

   And if you start whining about having to run a second program like
PGP after compressing, you're not working on a system that can be
customized enough, or are just spoiled rotten. Security can be an
*option*, not something required.

>Anyhow, here's another point of view on why proprietary formats exist.

   If you'd bothered to read *why* I've been railing against
proprietary formats, I have specifically said that if this is
something you want to do with a limited group, I don't give a *$#&
what format you use. However, the second you're trying to use a
proprietary format on *public* data transfer, you're alienating
folks. Use public formats in public. End of story.

Nathan Mates
--
<*> Nathan Mates http://www.visi.com/~nathan/      <*>
# What are the facts? Again and again and again-- what are the _facts_?
# Shun wishful thinking, avoid opinion, care not what the neighbors
# think-- what are the facts, and to how many decimal places?  -R.A. Heinlein