I am appalled at how unseriously 7-zip seems to take security.<p>The changelog only says &quot;Some bugs were fixed&quot;, with no mention that there are serious security flaws. The homepage doesn&#x27;t mention any vulnerability.<p>The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it would be a reasonable option); thankfully you can dig around Sourceforge downloads to find a SHA-1 automatically generated by Sourceforge. So I can personally verify the integrity of downloads, assuming Sourceforge can still be trusted, but 99% of users won&#x27;t do this, and more worryingly it&#x27;s a strong signal that the developers may not understand or value security very much: you have to wonder if maybe they&#x27;re not themselves downloading unsigned software over HTTP all the time.