Comment by goldsteinq

So the first scenario is also basically “automatic scanner bypass”? That answers my question, yes.

> making a tar file that when inspected looks fine

Am I correct in understanding that manual inspection would reveal a nested .tar archive (so recursive inspection of nested archives should be enough)?