[liberationtech] Arabic Pidgin-OTR Tutorial

[Uncle Zzzen]

On Mon, Nov 19, 2012 at 9:44 AM, Jacob Appelbaum <jacob at appelbaum.net>wrote:

> Uncle Zzzen:
> > One thing that baffles me is where's the sig or hash at
> > http://www.cypherpunks.ca/otr/ (which is not SSL).
> > I see sigs for lib, proxy, etc. but nothing for the primary download.
> > Unless there's something I fail to understans, it's pretty spooky.
> >
> >
>
> The signature is referenced as 'sig' on the page:
>
> This is a plugin for Pidgin 2.x which implements Off-the-Record
> Messaging over any IM network Pidgin supports. The current version is
> 4.0.0.
>
> indeed, I've found it a while later and said
> Anyway - turns out there *is* a sig. It's just well hidden.
> If you go down to other downloads<http://www.cypherpunks.ca/otr/#downloads>they have Windows (4.0.0) with a sig.
*> The 4.0.0 is a typo*. It's the latest version (4.0.0-1), and the
sig<http://www.cypherpunks.ca/otr/binaries/windows/pidgin-otr-4.0.0-1.exe.asc>verifies
it (at least in Thailand).

Maybe the word "typo" wasn't accurate, but if you look at the page, it
looks like 4.0.0-1 is the latest version and 4.0.0 is something older.
There's no "(sig)" link before the square brackets at
*Primary download:* Win32 installer for pidgin-otr
4.0.0-1<http://www.cypherpunks.ca/otr/binaries/windows/pidgin-otr-4.0.0-1.exe>[other
downloads <http://www.cypherpunks.ca/otr/#downloads>]*["actual" size]*

Eventually I've decided to tell someone "let's use 4.0.0 [that has a sig]
instead of 4.0.0-1":
Windows (4.0.0)Win32 installer for pidgin
2.x<http://www.cypherpunks.ca/otr/binaries/windows/pidgin-otr-4.0.0-1.exe>(
sig<http://www.cypherpunks.ca/otr/binaries/windows/pidgin-otr-4.0.0-1.exe.asc>
)
*["actual" size]*

*Only then* I've noticed that these links refer to the same version
(4.0.0-1).

Never mind the time it took me (and many other, I guess) to bang my head at
the wall trying to understand this. The result is a video that [as far as I
understand the Arabic] doesn't mention the issue of verifying the code
(downloaded through an http connection via an Israeli ISP), because (if I
understand correctly), Nadim couldn't find the sig on the site either :(
It's a very small html fix, and I'm glad to hear you're a maintainer and
can fix it.

Cheers,
The Dod
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.stanford.edu/pipermail/liberationtech/attachments/20121119/265282a4/attachment.html>