Vigdis:
>> I just met Tails and I would like to contribute.
>> My idea is to get flash usb sticks, put Tails iso on them, ready to
>> load, and start a campaign to give it to journalists and activists in
>> my country (Lebanon, LB). my flash usb stick costs 10$, so I would
>> sell it to journalists and acivists for 20$, and send the 10$ profit
>> to you and to EFF.
>> I will tell people that they can download it for free but this is
>> easier for them and they will be contributing to the Tails and EFF
>> project.
>>
>> is this okay with you?
>
> Although I' don't speak for the Tails project, I don't think is a
> good idea.
>
> The first rule in opsec[1] is: trust no one".
I wouldn't be as strict as Vigdis on this one, as you'll anyway have to
trust someone, or something while using Tails. At us, Tails developers
somehow.
> If you provide them a usb
> key with Tails already installed, they won't be able to verify that's
> the real Tails so they have to trust you that you either are honest and
> did it correctly.
But yes, the question here is that the people who will be using your USB
sticks will have to trust you. It might be ok for them to do so either
because they want an easy way to try our Tails or because you already
have a strong relationship with them. But at least you should make that
very clear to them.
An underlying technical aspect here is that it is not possible to verify
the authenticity of a USB after it has been installed.
See
https://labs.riseup.net/code/issues/7269
--
sajolida
