Re: [Full-disclosure] Re: tar alternative

[Tim <tim-security@xxxxxxxxxxxxxxxxxxx>]

> What problems ?

1. tar archives contain information about the user and group of a file.
   This is critical for backups, but quite unnecessary for software
   distribution in the vast majority of cases.  It is a common pitfall
   for software authors to leak information about their systems this
   way.

2. As discussed in this thread, tar archives contain permissions for
   files.  Also important for backups, not important for software
   distribution IMHO.

3. tar traditionally allows files to be extracted to any directory,
   which can be dangerous.


True, these behaviors can be overridden, or a tool developed that has
safe defaults, but then the tool would be less useful for backups.  The
point is, the Unix community has been using a backup tool for software
distribution for many years.  Perhaps having the right tool for the job
would be safer.

For instance, a format that only contained filenames and timestamps, and
is built to only output all files under a specific directory tree would
be nice.


> I would say cpio, but you don't want any backup designed archivers.

Yeah, I had thought of that as well, but it likely has the same issues.

thanks,
tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/