Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

An OPSEC community would probably say no, so I probably don’t need to ask in those communities. But I’m curious about a (digital) pirate’s perspective on this issue…

Still committing OPSEC crimes, but I'm not as bad as I could be :P

I mean, the sources listed here are supposedly “safe” right? But honestly, how much would you trust these “safe” sources?

I think we're talking about different sets of standards. Even with that in mind, my own "trusted" list is a much smaller handful of any list posted online. Trust in pirate spaces shouldn't mean at face value and should be constantly tested with stuff like virustotal. It just means I haven't been compromised or seen anyone else report back with an infection for a long stretch of time on a specific website. There's always occasional breaches as malware enthusiasts test the waters now and then, usually not with a big/popular release. Stuff that could fly under the radar. Usually it comes down to whether or not that website has an active comment section or forum with active mods/admins who stamp it out continuously. I tend to prefer traditional bulletin board forums. rutracker.org or cs.rin.ru. I still don't touch any file right away. I let other people be the "brave" lab rats. See if any squeal first. I tend to avoid niche application piracy entirely. Those seem (and have been in my youth) to be the virus hotbeds cracked by total unknown entities. Plus I don't mind paying for independent / small company niche software. Often enough in those cases I can find a free open source alternative anyways.

It's worked out so far. I haven't been compromised in my adult years. But this isn't some "do as I do" thing, it's basically internet street smarts. Comes with experience and infections. I minimize risk and can trust my gut now, but I acknowledge it'll never be risk free.

When doing sensitive tasks like banking or filing taxes, do you:

>Use a different OS on the same machine? (Dualboot)
>Or put the pirated content inside a virtual machine?
>Or just use a completely separate computer?

Separate computer. An otherwise useless old laptop running Fedora. OPSEC would probably say it's not good enough because it's on the same network as computers which installed pirated software.

And since PC is much different than a Smartphone:

Would the extra sandboxing on Smartphones make pirating games on a Smartphone much safer compared to on a PC? (Not that there are much mobile games worth playing, just curious)

GrapheneOS here which does sandbox better than most, but I don't use my smartphone for anything sensitive. That's really without trying to, it's just not something I ever felt the need to use a smartphone for. I'm not as familiar with Android/Linux as I am with Windows. I know exactly where to periodically check for telltale signs of infection on Windows. I can still bend that OS to my will even as it gets worse for most end users. I'm less sure of myself on anything else. Working on that, HTPC is Fedora KDE spin now. Like you say, not much mobile games to play. I think I've bought like...3 ever. So, never felt much need to sideload. I usually stick to F-Droid and NDS emulators anyways. I have a Picross / Picross 3D addiction.

Non-installed/non-executable files such as .mp4 .mkv .mp3 .pdf .epub, are mostly safe right? I mean, you are using another program to opening it, not executing a file, there aren’t much attack vectors as long as the video player / ebook viewer is up to date right? (Or am I understanding it wrong?)

Usually, but sometimes there can be a flaw in a specific application exploited. I don't think I know of any from media formats outside of maliciously edited ROM files smc or v/z64 for cartridge based system emulators like extremely outdated ZSNES or Project64 1.6 specifically.