Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

54500 readers

615 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others

Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

💰 Please help cover server costs.


Ko-fi	Liberapay

founded 1 year ago

MODERATORS

[email protected]

Why don't nfo files contain a checksum for the release? (lemmy.dbzer0.com)

submitted 11 months ago by [email protected] to c/[email protected]

12 comments fedilink hide all child comments

I assume there's some historical reason for this, but currently, the way scene releases reach most people seems to consist of:

Sites that track releases post the nfo file of the release; these sites generally don't provide the release itself.
People then look for the release via various channels and download it.

Wouldn't it make sense for the nfo to contain the checksum of the actual release, letting pirates verify unmodified copies of it and making it easier to avoid versions that have been modified in various ways?

Obviously you'd still have to trust both the site where you got the NFO (and therefore the checksum) and the people who made the original release, but those are usually relatively trustworthy, being known people who have handled a lot of releases with no problems - a lot of the danger of viruses and the like in software piracy comes from the risk of middlemen adding something.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 13 points 11 months ago (1 children)

@Yglorba

Good question. I guess people thought naively that .sfv files were enough, but of course that's not true.

Some .nfo files contain md5s for things, but that would be easily changeable.

It would have to be a cryptographic checksum, using something like GPG/PGP with a distributed fingerprint to be any good.

I've seen one or two over the years, but not as many as you'd expect for people that should be worried about security and image.