3 ms·
CDs are read-only, whereas a USB stick has (generally insecure) firmware that can be modified. So in a setting where the user is concerned about persistent USB
by throwaway7767 10y ago
CDs are read-only, whereas a USB stick has (generally insecure) firmware that can be modified. So in a setting where the user is concerned about persistent USB malware, it can make sense to use them.
It's a niche concern of course, but I suspect it's a little bit more common in the OpenBSD community than in many others. Of course it shouldn't be too hard for those users to build their own install boot CDs with the tarballs for installation, just skip the big package sets and install them later if the whole won't fit on the disc.
- soccerdave 10y agoWhat happens if your cd that comes in the mail is swapped out for a different cd by a malicious actor?
- kabdib 10y agoYou check hashes (from the web site) after you copy the files to media you trust, and then any tampering is really interesting . . .
- aruggirello 10y agoYou can find well-known hashes to check your install media with online (assuming you can trust the media because it comes wrapped up in a nice package is a bit naive...). What you cannot check however, is a USB key firmware (ring-0?) malware, that lives completely outside of disk space, and thus is beyond reach, but might have limited (or even complete) access to the system it is plugged to. CDs and DVDs (don't know, but perhaps SD/compact flash/etc. cards too?) are thus the last mainstream media that come with 'no firmware attached'.
- joyfulgerard 10y ago> What happens when a malicious actor leaves physical evidence all over? They get caught.