this post was submitted on 07 Dec 2023
83 points (98.8% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

54698 readers
542 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others

Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 1 year ago
MODERATORS
db0@lemmy.dbzer0.com
sunbrothersco@lemmy.dbzer0.com
dataprolet@lemmy.dbzer0.com
Flatworm7591@lemmy.dbzer0.com
RandomLegend@lemmy.dbzer0.com
83
Why don't nfo files contain a checksum for the release? (lemmy.dbzer0.com)
submitted 11 months ago by Yglorba@lemmy.dbzer0.com to c/piracy@lemmy.dbzer0.com
13 comments fedilink hide all child comments
 

I assume there's some historical reason for this, but currently, the way scene releases reach most people seems to consist of:

  1. Sites that track releases post the nfo file of the release; these sites generally don't provide the release itself.

  2. People then look for the release via various channels and download it.

Wouldn't it make sense for the nfo to contain the checksum of the actual release, letting pirates verify unmodified copies of it and making it easier to avoid versions that have been modified in various ways?

Obviously you'd still have to trust both the site where you got the NFO (and therefore the checksum) and the people who made the original release, but those are usually relatively trustworthy, being known people who have handled a lot of releases with no problems - a lot of the danger of viruses and the like in software piracy comes from the risk of middlemen adding something.

all 16 comments
sorted by: hot top controversial new old
[–] readme@lemmy.dbzer0.com 19 points 11 months ago* (last edited 11 months ago) (1 children)

Modern scene dosn't even require strict .nfo files. Most TV groups in WEB or HDTV sections just basic mediainfo and imdb link. Only the oldest and best scene groups do ascii art in nfo files.

P2P groups don't even have .nfo files and if they do its mostly foum html with mediainfo. Some include .txt with mediainfo only. I've only seen EVO p2p group do decent .nfo files.

However all scene groups are required to include .sfv rar checksum files. I've never seen any p2p groups do this. Most p2p groups .nfo files are forum html of mediainfo.

But when scene releases leak to public and unrared, files like .sfv deleted by uploaders. But you can use srrDB.com most of there .nfo include .sfv files.

[–] Cycloprolene@lemm.ee 1 points 11 months ago

most of there .nfo include .sfv files.

But they are mostly crc32, that's 100% useless.

[–] chewie@mammut.gogreenit.net 12 points 11 months ago (1 children)

@Yglorba

Good question. I guess people thought naively that .sfv files were enough, but of course that's not true.

Some .nfo files contain md5s for things, but that would be easily changeable.

It would have to be a cryptographic checksum, using something like GPG/PGP with a distributed fingerprint to be any good.

I've seen one or two over the years, but not as many as you'd expect for people that should be worried about security and image.

[–] liliumstar@lemmy.dbzer0.com 7 points 11 months ago

I've noticed some scene game/software releases have blake3 hashes now. That doesn't account for everything else, but I'd say it's a good step.

[–] Cycloprolene@lemm.ee 4 points 11 months ago* (last edited 5 months ago) (1 children)

93A1A71EABD6B6CD658458CC1F4

[–] eluvatar@programming.dev 1 points 11 months ago (2 children)

Uh... If they messed with the iso, they could very easily mess with the NFO

[–] Yglorba@lemmy.dbzer0.com 3 points 11 months ago* (last edited 11 months ago)

Yes, I mentioned that - but trusted public sources, who often post on places like Reddit or personal websites run out of the US and the like, can post NFOs but can't post the actual game. If you knew the correct checksum, you could then turn around and grab the game from an untrusted source.

Distributing the game itself is the dangerous part (in terms of making the copyright pinkertons come after you) so it's better if it can be done as anonymously as possible, but that conflicts with the need to have it distributed by someone trusted. Putting the checksum in the nfo, which is widely reposted by trusted sources, would help avoid this problem.

[–] Cycloprolene@lemm.ee 2 points 11 months ago* (last edited 5 months ago)

93A1A71EABD6B6CD658458CC1F4

[–] WarmApplePieShrek@lemmy.dbzer0.com 2 points 11 months ago

The SFV file contains checksums.

[–] MonkderZweite@feddit.ch 1 points 11 months ago* (last edited 11 months ago) (1 children)

What is a .sfv file some mention here?