[As usual when I write here, the header From: is a black hole. Use the
address in the signature to actually reach me.]

>> this only works if the user un-zipping the file is already root.
>> otherwise it creates an "sh" binary which is setuid to the user who
>> unzipped the file.
> If your homedir ...

[ more ]