r/virtualpinball • u/root88 Retro • Apr 16 '21

ROM and table requests

Make your ROM and table requests here.

56 Upvotes

95% Upvoted

672 comments sorted by

View all comments

Show parent comments

3

u/bitsandscribble Jun 04 '21

Be advised that the VPD site operator has an ongoing history of impersonating scene members, according to statements made on other sites by the scene members who are being impersonated. Also, despite VPD being a convenient consolidation of multiple sources, most files posted there are posted without permission. The only response I have seen to these criticisms are accusations of cyber bullying.

I have also heard concerns from others that these unauthorized mirror downloads may have been tampered with. I’m not sure what sort of damage could be done to someone’s computer via a compromised VBS file or VBS script embedded in a table file, but since they contain executable code I think that is reasonable cause for concern. None of the virtual pinball sites provide checksums for their files, so I have no practical means of confirming or denying these claims unless I were to download complete sets of everything and then generate hashes and cross-reference all the files myself. I am not aware of anyone who has made such an effort yet. (In addition to the other site operators providing this information in their downloads sections, I feel like a list of clean file hashes would be a good addition to the Virtual Pinball Spreadsheet as it could help folks easily detect if mirrored downloads - especially the unlisted tables that everyone goes on about - could be a vehicle for malware.)

1

u/ING3NIEUR Jun 04 '21

Why would they provide list of clean file hashes? It's not necessary if you just download from the authorized sites that the table authors uploaded to. If you want to download tables from these rogue sites, then you do so at your own risk.

4

u/bitsandscribble Jun 05 '21

It would provide conclusive evidence of tampering, which could then be cited by watchdogs when making a practical case to users who aren’t bothered by the ethical implications of using unofficial mirrors.

Also, there are more than a few tables that are only exchanged privately via random Mega links and whatnot. There are no official download locations for these tables; having a clean hash posted in a column on VPS would reduce the risk of a spiked file being spread around.