I assume there’s some historical reason for this, but currently, the way scene releases reach most people seems to consist of:
-
Sites that track releases post the nfo file of the release; these sites generally don’t provide the release itself.
-
People then look for the release via various channels and download it.
Wouldn’t it make sense for the nfo to contain the checksum of the actual release, letting pirates verify unmodified copies of it and making it easier to avoid versions that have been modified in various ways?
Obviously you’d still have to trust both the site where you got the NFO (and therefore the checksum) and the people who made the original release, but those are usually relatively trustworthy, being known people who have handled a lot of releases with no problems - a lot of the danger of viruses and the like in software piracy comes from the risk of middlemen adding something.
Modern scene dosn’t even require strict .nfo files. Most TV groups in WEB or HDTV sections just basic mediainfo and imdb link. Only the oldest and best scene groups do ascii art in nfo files.
P2P groups don’t even have .nfo files and if they do its mostly foum html with mediainfo. Some include .txt with mediainfo only. I’ve only seen EVO p2p group do decent .nfo files.
However all scene groups are required to include .sfv rar checksum files. I’ve never seen any p2p groups do this. Most p2p groups .nfo files are forum html of mediainfo.
But when scene releases leak to public and unrared, files like .sfv deleted by uploaders. But you can use srrDB.com most of there .nfo include .sfv files.
most of there .nfo include .sfv files.
But they are mostly crc32, that’s 100% useless.
Good question. I guess people thought naively that .sfv files were enough, but of course that’s not true.
Some .nfo files contain md5s for things, but that would be easily changeable.
It would have to be a cryptographic checksum, using something like GPG/PGP with a distributed fingerprint to be any good.
I’ve seen one or two over the years, but not as many as you’d expect for people that should be worried about security and image.
deleted by creator
I’ve noticed some scene game/software releases have blake3 hashes now. That doesn’t account for everything else, but I’d say it’s a good step.
93A1A71EABD6B6CD658458CC1F4
Uh… If they messed with the iso, they could very easily mess with the NFO
Yes, I mentioned that - but trusted public sources, who often post on places like Reddit or personal websites run out of the US and the like, can post NFOs but can’t post the actual game. If you knew the correct checksum, you could then turn around and grab the game from an untrusted source.
Distributing the game itself is the dangerous part (in terms of making the copyright pinkertons come after you) so it’s better if it can be done as anonymously as possible, but that conflicts with the need to have it distributed by someone trusted. Putting the checksum in the nfo, which is widely reposted by trusted sources, would help avoid this problem.
93A1A71EABD6B6CD658458CC1F4
The SFV file contains checksums.
What is a .sfv file some mention here?
Removed by mod
I agree that this would be handy as hell, but I have some guesses why it is rarely ever done.
- The majority of people (both uploaders and downloaders alike) are lazy and don’t bother with checksums. I would even guess that the majority of people who pirate probably don’t even know what checksums even are.
- In terms of validating the transfer, some P2P protocols like bittorrent have an internal validation method so any checksums manually validated by the user would be redundant. Obviously, this does not apply to all pirate sources like DDL etc but it definitely would act as “validation” for those already in the reason #1 camp.
- In terms of security, it would be easy as hell for a malicious party to generate a new torrent or new download with a new checksum. In some cases, like a single site controlled by the (re-)packer (e.g. like fitgirl for example), having a checksum on the site would still be beneficial to those that check since it would also help to identify frauds. In other words, if they were going to start doing checksums, I would hope that they were not only putting them into the NFO files.
- For the more secure checksum algorithms like SHA-256 and SHA-512, they can take awhile to generate on large files like an umpteen gigabyte. Not a big deal if you are just doing it once, but if you a releasing a lot of stuff, it would be one more annoying thing to take care of. Which is going to push some more people into the reason #1 camp.
- Sometimes there are multiple revisions or other variations (like Some Cool Game v3.14 vs Some Cool Game v3.16 or Some Cool Game with DLC edition) as well as potentially having multiple sources (Some Cool Game GOG version vs Some Cool Game Steam version vs Some Cool Game dvd version) - since each and every one of these combinations would need a new checksum, you’re basically in the same boat as point 4.
- There are groups such as rightsholders, malware creators, antivirus companies, and so on that have a vested interest in you either downloading fakes, installing malware, or having a real risk of malware. Probably only the first 2 groups would potentially be creating pirate releases but I doubt they’d intentionally make it easier to discover what they’re really up to.
- If the checksum were provided on the website, in theory, that would indicate that whoever generated the checksum had downloaded the file. So there could potentially be some legal foothold to use against a website that was providing the checksum. Maybe, nothing. And maybe that would just be something like a takedown letter (kinda like how links are treated today). But maybe something worse like site owner being liable to be sued / fined / imprisoned. Idk, I’m not a lawyer. Plus if a site was just copying whatever was in the NFO file, that would be worthless for security by way of point 3.
Point 2: “Sites which track NFOs” track NFO files of scene releases because noone cares about P2P NFOs. Scene releases are intended to spread on FTP, not BitTorrent. They also come with CRC-32 checksums in file extension .SFV
my bad. deleted my previous guesses since it seems i missed a few key words there