I've seen so far 2 different forks of the zip called Gaza Care Package: One fork is by @Crypt0nymous https://twitter.com/Crypt0nymous/status/269749439550328832 File: http://bayfiles.com/file/rPjj/a7ehrr/Op_Israel_Care_Package_For_Gaza.zip Sha1: e9f6de4fc3619c97d953e943605906f48eabfe67 Authenticity: retweeted by @BiellaColeman It contains 2 PDF files (potential vulnerability).
The other fork is maintained by anonrelations: http://anonrelations.net/opisrael-95/ and already has 2 versions v1: https://bayfiles.com/file/rVfF/vRRtdV/Op_Israel_Care_Package_For_Gaza.zip Sha1: 204ba3a73fe0864618163b130c39d4f58c5f3dbf v2: http://www.mediafire.com/?hpnne29xvx1ceuv Sha1: a9681e67bcf67a42cb859bef981ea373eeaa9419 Authenticity: @AnonyOps https://twitter.com/AnonyOps/status/269872081125134336 (v2 link is in the pastebin) Now *this* contains the windows vidalia .exe (in both versions). I've verified it against the sig at https://www.torproject.org/dist/vidalia-bundles/vidalia-bundle-0.2.2.39-0.2.20.exe.ascand it's "kosher" but there are 2 questions here: 1) Why vidalia and not torbrowser? Thee's a good reason why torproject makes it hard to download anything but torbrowser. "Barefoot Vidalia" is enough rope for beginners to hang themselves with. 2) Why distribute a .exe (or even .pdf) without means to verify its authenticity? The 2nd question is more critical, because now there are [at least] 3 zips called "gaza care package" going around Gaza on memory sticks, and people get used to the fact that not all of them are the same but "don't worry. it's got an anonymous logo png on it". Spooky. IMHO, It's easy to create an ad-hock trusted distribution system: You can have a wrapper zip containing the payload zip, and a README.txt (maybe call it IMPORTANT.txt) explaining how to verify it with a clause "if you don't understand how to do this, ask someone who does". How to verify? Easiest would be to write "the sha1sum of the zip can be found on the bios of @anonythis and @anonythat. we hope that you already know and trust at least one of them". You could also do that with gpg fingerprints but sha1 is easier to teach people (the geek who verifies the file for you can easily teach you how to verify future versions). Does it make sense?
-- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
