xX_sticky_Xx's Journal: Slashdot editors reject Xbox emu trojan confirmation

After running a virus scan with updated NAV definitions, a trojan, namely badcon, was detected in the Xbox "emulator" featured in this story. I promptly submitted a story detailing this discovery, only to have it rejected within 10 minutes. The trojan does not appear to be particularly malicious, only causing system instability on unpatched Win9x boxes, but the fact that the Slashdot editors refused to inform their readers that a program they featured on their site contains a trojan is irresponsible to say the least.

I have passed my concerns on to Slashdot's parent company, VASoftware, (a publicly traded company) and I encourage everyone to do the same.

It was covered already...

[mESSDan]

in the comments of the original post, thats probably why your submission was rejected. The "trojan" just exploits a bug in Win9x that causes a bluescreen and a reboot, that's it.

Maybe you should try reading the original article first?

That;s not the point

[xX_sticky_Xx]

Yes, I'm aware that it was covered in the comments but there was no admission by the editors that this program (that might I also remind you, had it been what it was supposed to be would have been illegal) did contain malicious code. Sure, it was relatively harmless...this time.

Don't you think that there should be an admission along the lines of "yes, indeed the program that we linked to has been shown to contain a known exploit"? I think that the eds do owe it to the readers to close the case on this, at the very least to assuage concerns people may have when they wake up in the morning to find (like I did today) that their virus scanner has detected a virus in a file linked to from their site.

IMHO, advising the "paranoid" to treat the file as a potential virus doesn't quite cut it.

Re:That's not the point

[xX_sticky_Xx]

Good points, all of them.

To tell you the truth, I only opened up this journal because someone asked me to after I put this in my .sig.

Myself, I never executed the program mainly because I share your concerns about code found on the net in general.

Here's something to think about though: Everyone seems to treat /. like any other blog or web board, with the same responsibilities (or lack of) as any other. This is not the case. /. also has a responsibility to a great many shareholders, both individual and institutional. Before you laugh at this considering VASoftware's stock price, let me tell you that institutional investors would not take this matter lightly at all.

Consider Sequoia Capital, that owns almost 5 million shares of VA. A $.10 hit in the share price equals $50,000 down the tubes. VA makes up 3.1% of their total portfolio.

Even more so, consider Lehman Bros. Asset Mgmt., who just bought 600,000 shares not too long ago. They're counting on these shares going up, not down.

Perception counts for a lot in the market. If 1,000 virus scanners are going off today from a file downloaded off a site linked from one that is traded publicly, someone is bound to notice. If word were to spread to investors, the first word that would pop into their heads is "LIABILITY". They would not care in the least about the nuances of trusted vs untrusted code or websites.

So you would think that /. would want to post such a story ESPECIALLY considering that the trojan was harmless. No harm done means everyone can relax and get on with their day. Not acknowledging it at all could leave doubt in some minds and doubt in the market=losses.

Did you expect them to admit it?

[GreenHell]

Seriously, no major gripe against the editors here, but look at the story... That first update, the one "Is this emulator a fake? according to these messages in the XBox Hacker web site - this is a fake one. Could someone actually try it?" was posted after there were tons of posts that pretty much screamed 'This is a hoax!' and what do they do? No 'this is a hoax' or anything, but rather 'would you please check it out, despite the fact that there's been comments almost as soon as this began that said it was a hoax.'

I do however, see that they admitted it was a hoax eventually... but it took them a day to do so (by which time, I don't think it was on the front page, as I didn't see that until I just checked a moment ago)

That said, I don't think they were wrong rejecting your story as there's not really much that can be commented on in it, but I do think they should have posted it in a slashback or something. I do however wish they would take a little more responsibility for this type of stuff though, or at least check out the links and (in this case) programs listed in their articles before they post them.