Full Disclosure mailing list archives
Re: Re: tar alternative
From: Tim <tim-security () sentinelchicken org>
Date: Sat, 9 Sep 2006 09:06:38 -0400
What problems ?
1. tar archives contain information about the user and group of a file. This is critical for backups, but quite unnecessary for software distribution in the vast majority of cases. It is a common pitfall for software authors to leak information about their systems this way. 2. As discussed in this thread, tar archives contain permissions for files. Also important for backups, not important for software distribution IMHO. 3. tar traditionally allows files to be extracted to any directory, which can be dangerous. True, these behaviors can be overridden, or a tool developed that has safe defaults, but then the tool would be less useful for backups. The point is, the Unix community has been using a backup tool for software distribution for many years. Perhaps having the right tool for the job would be safer. For instance, a format that only contained filenames and timestamps, and is built to only output all files under a specific directory tree would be nice.
I would say cpio, but you don't want any backup designed archivers.
Yeah, I had thought of that as well, but it likely has the same issues. thanks, tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Linux kernel source archive vulnerable, (continued)
- Re: Linux kernel source archive vulnerable Gerald (Jerry) Carter (Sep 08)
- Re: Linux kernel source archive vulnerable Hadmut Danisch (Sep 08)
- Re: Linux kernel source archive vulnerable Gerald (Jerry) Carter (Sep 08)
- Re: Linux kernel source archive vulnerable Hadmut Danisch (Sep 08)
- Re: Re: Linux kernel source archive vulnerable Michael Gale (Sep 08)
- Re: Re: Linux kernel source archive vulnerable Valdis . Kletnieks (Sep 09)
- Re: Linux kernel source archive vulnerable Ron (Sep 24)
- Re: Re: Linux kernel source archive vulnerable Jurjen Oskam (Sep 08)
- tar alternative Tim (Sep 08)
- Re: tar alternative Cristi Mitrana (Sep 08)
- Re: Re: tar alternative Tim (Sep 09)
- Re: Re: tar alternative darren kirby (Sep 09)
- Re: Re: tar alternative Tim (Sep 09)
- Re: tar alternative Aaron Gray (Sep 15)
- Re: tar alternative Tim (Sep 20)
- Re: tar alternative Jon Hart (Sep 20)
- Re: tar alternative Tonnerre Lombard (Sep 20)
- Re: Linux kernel source archive vulnerable Joe Feise (Sep 11)
- Re: Linux kernel source archive vulnerable coderpunk (Sep 12)
- Re: Re: Linux kernel source archive vulnerable Chris Umphress (Sep 12)