From owner-freebsd-stable@FreeBSD.ORG  Wed Dec  4 21:09:54 2013
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 0A6D7E03
 for <freebsd-stable@freebsd.org>; Wed,  4 Dec 2013 21:09:54 +0000 (UTC)
Received: from rush.bluerosetech.com (rush.bluerosetech.com
 [IPv6:2607:fc50:1000:9b00::25])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id CF9591143
 for <freebsd-stable@freebsd.org>; Wed,  4 Dec 2013 21:09:53 +0000 (UTC)
Received: from chombo.houseloki.net (c-71-236-222-167.hsd1.wa.comcast.net
 [71.236.222.167])
 by rush.bluerosetech.com (Postfix) with ESMTPSA id 83C1F11434;
 Wed,  4 Dec 2013 13:09:52 -0800 (PST)
Received: from [IPv6:2601:7:1680:365:6c84:41a:bb99:ad5e] (unknown
 [IPv6:2601:7:1680:365:6c84:41a:bb99:ad5e])
 by chombo.houseloki.net (Postfix) with ESMTPSA id 3BEEB59E;
 Wed,  4 Dec 2013 13:09:50 -0800 (PST)
Message-ID: <529F9A0F.3080608@bluerosetech.com>
Date: Wed, 04 Dec 2013 13:09:35 -0800
From: Darren Pilgrim <list_freebsd@bluerosetech.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.1.1
MIME-Version: 1.0
To: Ben Morrow <ben@morrow.me.uk>, freebsd-stable@freebsd.org
Subject: Re: 10.0-BETA4 bsdinstall zfs encryption broken
References: <CAAoTqfu904a=W8zZ_170bjVUUeqxe-Jajo_W=g+U2vk+wTdaeg@mail.gmail.com>
 <099CD122-B7D8-4FC1-9C99-F19248418CD0@fisglobal.com>
 <CAAoTqftxt74DEWjxeYtpaiavqiuj8_gawY4+GpHirWM-FPaKQQ@mail.gmail.com>
 <A7DF3606-B33E-4117-A1DB-FE759E0A0E5F@fisglobal.com>
 <CAAoTqfvaPb4go_d7aeU0sepmPAGey1WuAtxVYsour11DVTguBQ@mail.gmail.com>
 <20131204201312.GA39227@anubis.morrow.me.uk>
In-Reply-To: <20131204201312.GA39227@anubis.morrow.me.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Dec 2013 21:09:54 -0000

On 12/4/2013 12:13 PM, Ben Morrow wrote:
> Quoth Devin Teske <dteske@freebsd.org>:
>>
>> The procedure I use is to take the existing ISO and...
>>
>> 1. use mdconfig to access it
>> 2. use mount_cd9660 to mount it
>> 3. use rsync to copy the contents to a local dir
>
> It's more secure to use tar for these three steps. Filesystems generally
> aren't hardened against malicious input.

I'm curious about this statement.  What extra security would tar get 
you?  Tar would be faster, but I can't think of how it would be more 
secure since it's all going to end up on the same filesystem either way.