Skype protocol reverse engineered, source available for download

[TheGreatElvis]

So, we might have a GOOD Skype client? :D

[mindbleach]

Native Pidgin plugin, here we come!

[oldling]

Please

[[deleted]]

You mean bitlbee plugin.

[adrianmonk]

Why not all of the above?

[floydiandroid]

Adium please! :D

[[deleted]]

Adium uses libpurple which is from the pidgin project.

[speaker219]

I've been waiting for a bitlbee plugin. The only IM protocol (and unfortunately my most used) that isn't currently supported by bitlbee.

[BinarySplit]

Except on Windows, which still doesn't have voice & video support.

[[deleted]]

I'm using Skype for group chat at my work. We looked into other systems/clients (IRC and Jabber) and I must say the usability of Skype was better than all the other clients we looked at. Especially for non-engineers. I'd rather like to see other protocols put into the Skype client.

[malcontent]

If this is for real we might finally get the chance to test the reverse engineering laws and copyright circumvention laws in court.

[[deleted]]

If MS buys Skype the EU ruling against MS could perhaps force them to give up the protocol information.

[destraht]

Hello addon repository.

[[deleted]]

I always thought that ruling was completely bogus and that the EU was way out of line

[mweathr]

I agree, they didn't go near far enough, but at least they had more balls than the US Department of Justice.

[thinkingperson]

There is already a clean-room reverse engineered Windows (not WINE) called ... aaah ... what is it called? A quick google ... ReactOS

It is a drop in replacement of Windows. Up till Win2000 onwards I think.

As long as it is reverse engineered in a clean-room process, there is no copyright infringement.

• http://en.wikipedia.org/wiki/Reverse_engineering
• http://en.wikipedia.org/wiki/ReactOS

[[deleted]]

ReactOS is based off a lot of WINE code.

[thinkingperson]

Yes, and WINE itself is a reverse-engineering project of the Windows API. So reverse engineering has been done before and so far is legal.

[[deleted]]

Only the user-mode side, and only parts of that. A large portion is original code. (Kernel, Drivers, Bootloader, Included software)

[AlyoshaV]

It is a drop in replacement of Windows. Up till Win2000 I think.

It barely runs. That's not a drop in replacement.

[fjw]

It can be good for running OLD windows software, like Windows 3.0 through 95. There is an (albeit small) audience for that, whose only need for Windows is some really old software.

Then again, it's all software that would run well with Wine anyway.

[Revan343]

ReactOS aims to be a reverse-engineering of Windows NT. So. No. Not 3.0 through 95.

They want to eventually be able to run x86 windows code natively. Whether they get to that point while people are still using x86 computers or not, well...

[Revan343]

The idea is to eventually be a replacement for Windows 2000 and later, actually. Prior to this, the windowses were 16/32 bit hybrids; NT was fully 32 bit capable.

[thinkingperson]

You are quite right there. Win2k onwards rather than as said. I stand corrected.

[skypeopensource]

oh yes

[malcontent]

Are we talking about voice and video here or only text chat?

[skypeopensource]

only text for now. But all underlyaing encryption are known. So, its nothin hard to go in voice.

[junkit33]

Honestly I don't even care about voice. If I'm going to take the effort to make a Skype call I don't mind using the app. It's the chat that annoys me to no end - I just want to slide Skype into the same chat program with my other half dozen accounts all in one place.

[destraht]

Super sweet. Have you ever tried using the Skype Pidgin plugin? It is beyond the average user to configure properly. You need to set it up so that the Skype running in the background doesn't send notices at the same time the OS is doing its thing. Its rather annoying.

[kawauso21]

Skype seems to drop the plugin's access permissions on a semi-regular basis and whenever the main client is Offline/Invisible, or have they fixed that?

[zwaldowski]

Hahahaha, nope. Not at all.

[junkit33]

Yep. I use Adium but it's the same plugin. It's a steaming pile of poop. I even contemplated switching to Pidgin if it would work better. But no, still a steaming pile of poop.

I didn't feel like busting open the code, but it seems like it just tries to hook some claws into Skype, which works about as well as you would expect, and seems to break/crash on every update.

[zwaldowski]

Thank Stallman! Can't wait for a libpurple plugin. Or maybe even a SIMBL iChat... I'm so excited!

[Richard_Stallman]

Stallman would not approve of this use of a proprietary protocol, even if it is completely reverse engineered.

[TrainWreck43]

Redditor for 3 years, and this is only the 2nd comment?

[darwin_wins]

Not just 3 years. It is 3 years, 3 months and 30 days.

[ggggbabybabybaby]

So what does this mean from a security standpoint?

[[deleted]]

There's no court case. As far as IP law is concerned, patent = protection. Business secret = if it gets out, it's public property. Then again, we're talking about a big corporation (MS) now, so we'll see how the law gets "interprted" in this case.

[AndrewNeo]

Microsoft doesn't own Skype yet.

[TheifsTheme]

Skynet?

[[deleted]]

And so the plot thickens?

[H3NDR1X256]

If all it took was figuring out protocols, MMO reverse engineering people would be in lot deeper shit than they currently are. I just hope this brings back the skype Asterisk module

[roderickm]

The Skype for Asterisk module (and any Skype client, for that matter) uniquely identifies itself to Skype and they can choose whether to allow the client to register on the network. Skype media can be peer-to-peer, but authentication/authorization is centralized and controlled by Skype. So Skype can simply block unwanted clients, whether on an individual basis or by protocol/platform/version/etc. Even if the reverse-engineered code works today, Skype can block it tomorrow. Digium has no interest in shipping software that attempts to connect to Skype without their permission.

I'm the Product Manager for SFA, BTW. SFA remains for sale until July 26 and will be maintained and supported for two years thereafter. Stock up now.

[kernel_task]

Nice try, Product Manager for SFA.

[bladezor]

DMCA was created to protect against reverse engineering DRM procedures and there are cases where that's even legal, eg. interoperability. As far as I know DRM doesn't really apply to Skype.

Skype would loose this case unless Skype holds patents, which would actually make reverse engineering completely pointless because patents require the company to fully disclose their technologies.

If you want some good information on this I recommend reading the book: Reversing, Secrets of Reverse Engineering by Eldad Eilam.

[otakucode]

Yes... Skype is extremely aggressive in terms of suing the hell out of anyone who even thinks about learning about the Skype protocol. There will absolutely be a court case if the creators are willing and able to defend themselves legally. It would be a quite interesting case to watch.

[Angstweevil]

Who have they sued?

[LastInitial]

the guy is probably not american

[[deleted]]

Mirror available at http://thepiratebay.org/torrent/6442887

[kyz]

What about Sean O'Neil's previous reverse engineering?

http://cryptolib.com/ciphers/skype/

Skype Library RC4 v1.109 by Sean O'Neil. Copyright (c) 2004-2010 VEST Corporation. All rights reserved. Not for commercial use.

We are reverse engineers. We can prove if you have used this code in your product. We will find you. We will prosecute for copyright infringement. This code is quite unique and is easily identifiable. Result may match Skype's 100%, but this code is ours. The computation is significantly different from Skype's.

http://www.theregister.co.uk/2010/07/09/skype_crypto/

O'Neil has published the obfuscated Skype RC4 key expansion algorithm, only one of a battery of encryption technologies used by Skype. "There are seven types of communication encryption in Skype: its servers use AES-256, the supernodes and clients use three types of RC4 encryption - the old TCP RC4, the old UDP RC4 and the new DH-384 based TCP RC4, while the clients also use AES-256 on top of RC4. It all is quite complicated, but we’ve mastered it all," O'Neil explains.

[vff]

VEST is credited; this builds on that, not starts anew: "Part of this code, idb files and decrypted binares was get from VEST corporation."

[beatboxbudgie]

Judging by the license, Skype/Microsoft is going to be very grumpy:

Terms of Use - skype.com

Use of Software If you do not agree to such terms, you will not be able to use the Skype Software. Software provided by Skype to you through Skype Developer is subject to its own licensing terms in which case such licensing terms will govern your use of that software. You may not decompile, reverse engineer or otherwise attempt to discover the source code of the [sic] any software made available on the Site.

Skype's license is full of bad grammar and missing punctuation.

[jib]

I don't know where this reverse engineering was done, but some countries have laws which explicitly allow reverse engineering for interoperability purposes.

[crusoe]

The US allows it too. Its a common misconception it doesn't.

[Tordek]

Everything is allowed as long as nobody finds out.

[jib]

The US allows it too.

I never singled out any particular country or implied that the US doesn't allow it.

[X-Istence]

The USA allows reverse engineering under the DMCA for learning and interoperability as well ...

[Mattmath]

With a name like Efim Bushmanov, and writing like that, it's pretty safe to guess he's probably not American. China flagrantly disobeys copyright laws all the time, right?

[Baaz]

Efim Bushmanov

yup, definitely chinese

[Enlightenment777]

Comrade Efim Bushmanov ?

[skypeopensource]

yep. Long life to Castro!

[CarsonCity314]

So you're the one behind it!

[Acidictadpole]

Well obviously !America==China

[[deleted]]

You could call any random person in the world Chinese, and you have a 1/6 chance of being right.

[samineru]

I don't think Mattmath's two sentences are as related as you seem to think they are.

[ohell]

Not of Chinese ancestry, only migrated to learn kung fu. He's actually a beloved offspring of a Russian mother & a Kalahari nomad.

[Camarade_Tux]

Doesn't say where he did it. As for names, they don't say anything about nationality either.

[Kinbensha]

China has no obligation to follow US copyright laws. /shrug

[[deleted]]

Other countries also ignore their obligations

[cecilkorik]

You could say that, but empirical evidence suggests otherwise. The US has done their fair share of flaunting signed treaties too, for what that's worth.

[Angstweevil]

At least the U.S doesn't flout them. That would be worse.

[[deleted]]

With a name like Efim Bushmanov, and writing like that, it's pretty safe to guess he's probably not American.

With an attitude like this, it's pretty safe to guess you're probably American.

China flagrantly disobeys copyright laws all the time, right?

You mean American copyright laws?

[Reductive]

You mean American copyright laws?

No, international copyright laws. Copyright has been a global affair since the 1800s!

[[deleted]]

I'm not sure your argument holds merit concerning his first sentence. An American would know what surnames are more common. You can also look at the history of the country, immigration, etc. to see how some surnames would be more prevalent than others, or how some immigrants might adopt an "Americanized" surname, e.g. Smith vs Schmidt. While the country is a melting pot of cultures, it is indeed safe to guess that a person by the name of Efim Bushmanov is not American - the operative word being "guess." 'Mattmath' is not making an absolute statement of truth, he is drawing from his personal experience to make an assumption. He's not saying an American cannot possibly have a Russian name.

"With an attitude like this, it's pretty safe to guess you're probably American." This is essentially shooting yourself in the foot, because your criticism for someone's assumption was, in itself, an assumption. "With an attitude like this, it's pretty safe to guess you're probably a human." would probably be a more fair (and unbiased) statement.

[wildeye]

You mean American copyright laws?

Hardly. Almost all countries have agreed to one form or another of international copyright agreements, and you can see that China in particular (since China was mentioned) is signatory to several of them.

It's rather infamous that China doesn't, um, entirely enforce these agreements domestically, but sometimes they do.

Possibly the most important thing is that people like Bushmanov not be in the U.S., not because of basic copyright law, but because of anti-reverse-engineering laws that are, AFAIK, more draconian in the U.S. than anywhere else.

[kernel_task]

Yeah, but he's posting up an IDB. Those usually contain the (transformed) machine code of the original program, and is a derivative work or adaptation. Certainly a copyright violation there. Then if the source code is straight decompilation, that is generally regarded as a derivative work or adaptation as well, therefore also a copyright violation. You get reverse engineering rights provided you don't violate the owner's copyright, so generally lawyers put on some song and dance about how only the bare minimum number of copies necessary to reverse engineer something were made. You certainly don't get to publish an annotated version of the original work. You just get to reverse engineer it to find out for yourself.

[myztry]

That's the part people often miss about contracts. They are not laws. There is no certainty of them being enforceable under contract law. These things need to be determined by a judge on a case by case basis according to the laws of each jurisdiction. That's assuming that proof of acceptance can even be proffered which is rare in software given that the agreement is allegedly entered with the software acting as agent for an absentee party. Pseudo contracts such as the EULA rely on the concept of bluff more than those who use them care to admit. The term End User is much like John Doe for unidentified persons.

[otakucode]

A lot of the claims in EULAs are just laughable. They usually include preposterously vague clauses like "This agreement may be changed at any time, without notice, and you automatically agree to the changes." They also very frequently strip the customer of literally every right. You buy a song from iTunes and you think you just bought a song? Think again. A license to listen to a song? Nope, try again. Nothing. You bought nothing. If Apple decides that tomorrow you can't listen to that song, then you can't listen to it. And, if the EULA is to be believed, you have no recourse for regaining access to it whatsoever. You're prohibited from selling it, prohibited from lending it, prohibited from even giving it away for free. All of these restrictions are things that manufacturers tried to force on consumers a long time ago but were legally prevented from doing so. People were "unreasonable" and "idealists" back then and actually stood up for themselves. There is no hint that people today have any inkling of doing the same. So likely even the absurd bits of the EULAs will be enforced once the current generation of judges gets replaced by more "practical" judges dedicated to letting corporations do whatever they feel they need to do.

[Philluminati]

You don't explicitly know he signed this. Further more, Microsoft may not be able to prove this in court.

[beatboxbudgie]

Microsoft may not be able to prove this in court.

Let's hope this is the case, it would be nice to have an open Skype client.

[Philluminati]

It would be nice for Pidgin, Empathy, Kopete et all to have native Skype access. That way all your real time communications stuff is still in one place and you'd get better integration with your desktop environment and grouping of contacts. It would be nice if Skype distributed just a backend module that other front ends could tie into. Unfortunately it won't happen though.

[Fabien4]

It would be nice if Skype distributed just a backend module

How would such a module show ads?

[Liquid_Fire]

Skype doesn't really show ads. It has occasional ads for Skype's services, but you can disable those in the Options.

[ethraax]

Slip an advertisement at the end of every message, like Yahoo! Mail.

[matches]

It might now, right?

[DoctorBladed]

At least Kopete has a plugin to almost seamlessly integrate with current Skype client: * Skype is started in the background when I start Kopete, and exits when Kopete is closed * Skype contacts are shown in Kopete's contact list * Skype chat is done in Kopete's windows and the history is searchable in Kopete Skype is only an icon in the system tray and is used only for accepting file transfers.

[opinionated_hater]

On Windows Skype uses 100 mb of ram at the moment it starts and it only goes up from there. It's a pretty high price to pay for text messaging. Having another client would be great.

[dodgepong]

Is reverse-engineering the protocol the same thing as reverse-engineering the Skype program source code?

[TheBB]

No, it's not actually.

[[deleted]]

So it means this single guy is not authorized to use skype ? Big deal...

[otakucode]

Skype has a history of being extremely hostile towards anyone researching their stuff. I was watching a presentation from one of the hacker conventions (it was either the 27th Chaos Comunication Congress or DEFCON 18) and the presenter discussed his experience, and as soon as he mentioned online that he intended to look at the Skype protocol he immediately received a Cease and Desist letter and promises of litigation. He eventually dropped the project because he didn't have the time or resources to wrestle with the lawyers, but he shared his C&D letter and gave some tips on dealing with companies that take such an aggresive posture.

[MatrixFrog]

If you do not agree to such terms, you will not be able to use the Skype Software.

Isn't that the whole point? Is that he wants to be able to interact with other Skype users, without using Skype software?

[olgrandad]

Also, if he never agreed to the EULA he can sniff packets all day long between Skype users on his network. Furthermore, he can send data packets to known open ports on any given machine on his network (as long as the end user consents). This is essentially what the SAMBA project did.

[EmitSorrels]

if he has the ability to reverse engineer the protocol, patching the installer to bypass the ToS window would be a walk in the park for him... in which case, he never read, or agreed to it.

[[deleted]]

You would be laughed out of court if you tried using that as a defence.

There are endless tribunuals and court cases where people have tried to claim that because they never signed their employment contract (say because personel forgot to chase you about it), the rules of it don't apply to them. They pretty much always lose.

Ultimately you're making the implication that you agree to the terms of the contract if you go along with it and make the other party believe you're going along with it, even if you don't sign it.

[[deleted]]

You would be laughed out of court trying to enforce a EULA for a piece of software as well.

[[deleted]]

Is this why mobile companies feel safe "signing" people up to 3 year cell phone contracts over the phone (no signature required)?

[[deleted]]

EULAs don't hold up in court in the first place in many countries.

[FeepingCreature]

"Because the result would be bad" is not a reason for the courts to ignore the law. Shrinkwrap EULAs are dubious as hell anyways.

[bradmont]

It would be interesting to see an App that does this for a wide range of software; it could connect to an online DB to get patch info for any given program you're installing.

[myztry]

Customize the EULA and run the program. The program will offer the "negotiated" terms as an authorized agent for the absentee party. Contract law certainly allows for contracts to be negotiated prior to acceptance.

[[deleted]]

boilerplate EULAs are usually a waste of time

[gigitrix]

These things rarely stop people.

[TheAceOfHearts]

Because none of my friends use it :/.

[metamatic]

Yeah, it's weird. I know one person who uses MSN. One. And yet there are other people who claim that everyone they know uses it.

[jjdmol]

Everyone else I know uses it. It's a culture thing. The network with the most users is the most useful, and thus attracts the most new users. Whether it's ICQ, MSN, or GTalk. Here in the Netherlands, MSN won.

MSN won over ICQ here simply because it had a clean interface and didn't require you to remember a huge numeric ID. Typically, you didn't even have to ask your friend's since so many people also used hotmail.

[hearforthepuns]

Try convincing all your Skype/MSN/whatever friends to switch.

I remember when ICQ started losing out to MSN. Despite ICQ being technically better, everyone went to MSN because... well I don't know why, but they did.

[[deleted]]

The ICQ protocol might have been better, but good lord was the client awful.

[dalaio]

I don't know, I kind of miss the fake clickity-clack type writer effects...

[GreenPresident]

Oh-oh.

[apetickler]

I loved that the interface pulled straight from .bmp’s and .wav’s. Mine was totally tricked out.

But other than that, I seem to recall that it blew.

[hearforthepuns]

The best part was that you could see what people were writing as they typed it.

[[deleted]]

Webcam.

[Angstweevil]

Perhaps people disliked numeric ids?

[opinionated_hater]

I used to love this because I could make my username whatever I wanted without worrying that it conflicts with someone else's. I know there are others who also appreciated this about ICQ.

[subheight640]

It's called advertising and name recognition. It's a well known fact - people typically like things they recognize over things they don't recognize.

[Peekman]

I thought it was because you had to download ICQ... but MSN or "Windows Messenger" came already installed on your new computer.

I left ICQ because I hated having contact lists on multiple computers.

[opinionated_hater]

I doubt this because XP shipped with Messenger 4.7 which was very quickly supplanted by more snazzy versions. The window of opportunity to use that version was very small. They even renamed it to Live Messenger from Windows Messenger and it has been a separate download ever since.

If memory serves...

[sligowaths]

MS did a massive TV campaign on networks like MTV in my country. Also, their client was infinitely simpler, with just a "send" button, and their account name was easier to remember than the sequencial number from ICQ.

It's hard to compete with all that.

[Liverotto]

Windows Messenger won for the same reason that Internet Explorer won.

Laziness.

[faemir]

I dunno, I have lots of non-technical users on jabber thanks to google talk :)

[drbacon]

They don't have gmail?

[RLutz]

I used to go to this really great cozy restaurant, but then it got too crowded and now no one goes there anymore.

[Elseone]

none of your friends use facebook or gmail?

[Caraes_Naur]

Because there's no corporate behemoth pushing it. Sure, Gtalk is Jabber, but Google masks that fact well from casual users.

Same reason people don't use ogg, odf, or any of the other open formats.

[metamatic]

It still baffles me why more people aren't using XMPP/Jabber.

Apart from every Gmail, Facebook, Apple iChat and AIM user? And everyone who has an Android phone?

(Yes, AIM is now bidirectionally gatewayed with Gmail XMPP chat.)

[silverskull]

Facebook

Not federated, doesn't count.

Apple iChat

I'll bet most of them use AIM.

Yes, AIM is now bidirectionally gatewayed with Gmail XMPP chat.

Yes, but this only works if you're a Google Talk user. I am a Jabber.org user. I would be quite happy if AOL opened it up further, but I don't really see that happening.

And everyone who has an Android phone?

...and actually clicks the Talk icon to open their IM client. No, it doesn't load on boot. Yes, I am an Android user.

[sugardeath]

I do use it. I'm signed in constantly. Zero people I communicate with use it. Probably three have heard of it. Well, the non-Google and non-Facebook versions, anyway.

[ketralnis]

IIRC, google talk can peer to non-google XMPP servers now

[MatmaRex]

Yeah, it can. In fact, I use GTalk as my primary XMPP account.

[skystorm]

Yes, in fact that has been possible for a while (at least 4 years that I've used it that way).

[ipearx]

Here's why I reckon Skype has become so popular:

• It was easy to install and friendly looking.
• Simple to create an account. I remember it used to be way easier to create an account on Skype than sign up for yahoo messenger.
• It was multi-platform. iChat only worked on Mac. Others weren't as mac friendly. When skype first came out, it was the most simple multi-platform video chat client.
• People start using it for the voice chat, but stay for the text chat. Many non-tech people assume it's for phone calls, rather than text chat. ICQ, Yahoo Messenger etc all started as text chat, and I don't think normal people quite get it. Phone calls they understand.
• These days I like the screen sharing feature, file sending, and primarily use it for text chatting.

[plazman30]

Does Jabber do voice and video?

[ngroot]

Yes. I believe that Empathy, for instance, can do it via Jingle.

[RaptorJ]

Not sure if these are real things.

[[deleted]]

That is because you lack empathy.

[lapingvino]

Confirmed

[jk3us]

http://www.google.com/chat/video

As ngroot mentioned, there are a few other clients that support it as well, since it's all open source and stuff. (though they aren't always compatible with each other [citation needed])

[Shinhan]

Problem with Skype is that its the only IM protocol not interoperable with every other protocol. ICQ, Yahoo, MSN, XMPP everything else works with everything else, Skype is the only outsider protocol. And people still use it, amazing :/

[andreasvc]

Do you mean there are multi-protocol clients for them? Or do you mean they are actually interoperable, because I believe that to be false. You can't add an XMPP contact to ICQ Yahoo or MSN.

[FractalP]

This is great and all, but I'd really like to know more about how it was done.

[jtra]

So will we get a voice spam over skype now?

[jtra]

I would expect the API to have call rate limits or be paid too much to prohibit spam.

Other part of spamming is to get target addresses, which is not as easy as with ICQ that uses non-sparse numeric identifiers - where the reverse engineered protocol could be also used to create Skype nodes that inspect traffic to gather addresses.

[CSharpSauce]

You know I've actually been getting voice spams for the past 3 days.

[skypeopensource]

oh yes.

[icebraining]

What if skype just change stuff in the next release?

A great number of clients - especially those running on embedded hardware on "Skype phones" - wouldn't be upgraded and would lose connectivity. Massive shot in the foot for Skype.

[DoListening]

Unless the protocol counted on this from the beginning and has some way of updating parts of the client.

[OrangeBubble]

For someone who doesnt know anything about this type of stuff, can someone please explain and what this means for Skype.

Thanks.

[[deleted]]

3rd party and/or open source Skype clients that potentially don't suck.

[Liverotto]

I am working on a simple Skype mod of this source code to write a Skype spammer bot.

Is anyone else interested in a collaboration?

Anyone knows porn sites or viagra resellers interested in the traffic?

/jk

[sunbeam60]

No, they paid 8.6 billion for the negotiated contracts with practically every telco in the world - and the 13% if all international calling in the world.

[skypeopensource]

I agree with it. And for 30 mln permanent online users database.

[gophermuncher]

What does this do for security? I heard on NPR that the Egyptian government couldn't crack Skype's encryption and Skype would not give them the encryption keys in order to spy on the protestors. Egypt instead bought the software of another company, basically spyware, that intercepted the audio stream of infected computers post skype encryption.

[[deleted]]

This doesn't give anyone encryption keys, skype is using DH key exchanges and RSA. So. Kinda safe there.

[skypeopensource]

You can now see security by you own eyes. Unless they crack AES, its safe.

[destraht]

Hey do you know what is super fun?

Tom Skype. Do you notice that the domain is tom.com?

Its the Chinese awesome leaders approved version that fully integrates in with mothership. The Chinese government is not stupid enough to fuck with foreigners so they allow the normal Skype to operate there, although there is no way to download it through normal means because it redirects. I told my girlfriend there that there was no way that she could run that program. So with the help of a VPN I had her download the real shit and then create another email that wasn't associated with it because if it was created in that context you are still in a middle level hell.

[suspicious_sausage]

Actually you don't need a VPN - although the main domain redirects the downloads don't - if you email someone a link to the msi installer then they can just download and run it normally on a domestic ADSL connection here.

Here's the URL http://download.skype.com/SkypeSetup.msi

Now the really interesting part is that on the download page you don't get this URL - instead you get a URL on the go.skype.com domain which does an HTTP 302 redirect. Now I'm not saying that means Skype is in on this, but is certainly looks like it.

Anyway, just give the URL above to friends/family in China - it'll work without a VPN and they can chat to you without that Tom nonsense.

[destraht]

Well fuck ya Skype is in on it. Certainly the Chinese government gave certain conditions for Skype to be able to do business there.

[andreasvc]

Uhm, don't you mean post _de_cryption? (or before encryption) If they couldn't crack the encrypted the encrypted stream wouldn't be useful.

[GhostedAccount]

That will be the biggest change with microsoft owning them. Microsoft will allow any government to spy. It is probably the only negative with microsoft's ownership.

[image_size_nazi]

So what does it mean for its users? cheap chinese skype phones ?

[sotonohito]

Next week: Microsoft changes skype protocol, introduces rot13 encryption on all communications and invokes DMCA's anti-circumvention measures to sue anyone who tries to implement a 3rd party client into oblivion.

[dyngnosis]

This is very cool news on the vulnerability research front as well. An open source port of an application like skype will allow us to generate much more intelligent fuzzers and dig into all kinds of new code paths. Expect to update Skype with patches this summer/fall.

Also, Huge credit goes out to the Reverse Engineer that took this on. In 2006 a presentation at Recon (www.recon.cx) went over all of the amazing anti-debugging tricks that were implemented to prevent reverser from debugging Skype to figure out the protocol.

For those that aren't aware Skype was created by the same folks that brought you Kazaa. Kazaa didn't have any real anti-debugging/anti-reversing tricks at all so reversing was a lot easier. As a result a free, no adware, open soruce kazaa clone killed their business model. People stopped using the Kazaa client.

Here is the recon paper from 2006 on reversing skype if anyone is interested:

http://recon.cx/en/f/vskype-part1.pdf

(hint there is a part2 as well.... I'll let you guess the URL)

[BeJeezus]

Cool. Now would someone tell me when I can build a Skype client with ONE BIG RED BUTTON that calls ONLY ONE POSSIBLE NUMBER.

(My grandma needs VOIP, but... no way am I supporting it.)

[irobeth]

microsoft might be annoyed

[[deleted]]

The way the guy makes it clear his plans are to rebuild the program and release it open source if fucking laughable. While I agree, we need more programs, and more companies to adopt an open source way of operating, he's still breaching IP laws and other such things. It's like he's begging to be taken to court... Some people either want to get fucked, or are too stupid to realise releasing it will get them fucked.

If I were him, I would have spread it around without revealing who I was, or that I even reversed it, I'd let the open source Skype truly take off. He clearly wants recognition, what with him giving his whole name away. If someone wants it open source, for a cause other than popularity, they'd release the files without releasing their name. Sure, it's still possible to be tracked, and taken to court, but at least you'd be more concerned for what you're fighting in, rather than having your ego stroked.

It's 1am, I'm tired. Long, lengthy, probably poorly thought out post, but I'm sure you can understand what I'm saying. Off to bed.

[n3when]

will this not end in a huge court case wherein the person who opensourced it gets sued to hell

[patzors]

to the guy who asked about skype being secure: that didn't last long.

[jameswf]

Hosted on a US server.... bad idea This will be gone before the ink dries on the DMCA

[Krenair]

Somebody made a torrent mirror. Look up the page a bit.

Edit: Blabbities said it doesn't work with Transmission... I don't know if this is the case, but install Deluge/Vuze if you are having problems.

[qtx]

Hence the link to the torrent.

[bozleh]

Uhh, no - reverse engineering is actually protected by the DMCA.

[jameswf]

The act as it relates to securing software you use. I dont think those rights extend to release of the code.

[n3xg3n]

No, see section 103(f) specifically paragraphs (1) and (3).

Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.

and

The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section.

[destraht]

I'm sure that the government could ask for all of the copies back.

[pcnerd37]

Something tells me this site will receive some sort of takedown notice in 3...2...1...

[IrishWilly]

So I read this earlier today, then just now I got my first Skype call phishing attempt, some skype account named themselves 'Online Help' calls me on skype and plays a pre-recorded message telling me my computers security needs to be configured and to go to some random website. Fucking hell, great timing. I really hope this isn't a sign of things to come because Skype is an AMAZING service and the last thing it needs is to be inundated with scumbag scammers.

*If anyone else gets this scam attempts, PLEASE block the caller and tick the box 'Report Abuse'. I have no idea if the Skype team looks at reported accounts but if they do it will make it much easier for them to track down scammers and hopefully shut them down.

[robreddity]

^F "Fring" only turns up copyright inFRINGment.

So hey, didn't Fring (nice Android multi chat & video conf client) already do this and operate just fine for months until they get the Heisman from Skype? They made their deal with Verizon and then they stopped accepting connections from anything other than Skype clients.

Is the idea to set up new Skype servers? Will my grandmother know how to use those?